I am having an issue with outputting a Date/Time stamp. Here is the scenario:
- Indexing a CSV file containing a field "Current_Date"
- In my output file, I am concatenating that "Current_Date" field with the Splunk _indextime into a field called "CreateTimeStamp"
- However, this is my output --> Current_Date value is '1', _indextime = "15:40". Need it to look like "10/14/2012 15:40"
Snippet from prop.conf:
SHOULD_LINEMERGE = false
BREAK_ONLY_BEFORE = \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}
TIME_PREFIX = ^([^,]+,){9}
TIME_FORMAT = %m/%d/%Y %H:%M
LINE_BREAKER = ([\r\n]+)[A-Z0-9-]+,
REPORT-csvepo3 = csvepo3
TRANSFORMS-removeheader4 = removeheader4
Snippet from transforms.conf:
[removeheader4]
REGEX = ^System_Name,Last_Comm,Last_Comm_Diff
DEST_KEY = queue
FORMAT = nullQueue
Any suggestions?
