Hi, I have a problem with timestamp recognition in the following logs:
The originating log source outputs records (pipe delimited) with the following as timestamps :
As you can see, the logs do not have leading zeros if the time is for example "00:00:09 AM", the logs would output as "9"
I know how to solve this during search time by doing some evals and zeropadding and then using strptime.
However, what options do i have to solve this during INDEXING time?
Thought of doing a transform and creating a newfield however i quickly realised timestamp recognition is done before transforms.conf.
strptime only has %k for single digit HOURS, I've run out of ideas for a custom datetime.xml.
Would appreciate any help on this.
Try setting that
sourcetype up with three different
timestamp formats, in order, with the first assuming there are seconds only, the second assuming minutes and seconds, and the third assuming hours minutes and seconds. You will need to include the trailing pipe symbol into the format to make that work, so it would be something like this...
[timeattempt1] %Y%m%d\|%S\| [timeattempt2] %Y%m%d\|%M%S\| [timeattempt3] %Y%m%d\|%H%M%S\|