I would like to combine extracted values into a single field. Here is my transform
[end_time_extact]
REGEX = (\d+\/\d+\/\d+)[,](\d+:\d+:\d+)
FORMAT = end_time::$2
A comma seperates yy/mm/dd from hh:mm:ss and i would like to join the two into a single field.
Suggestions? I've tried
FORMAT = end_time::$1:$2
along with many other variations
Do it in reverse order like this:
[end_time_extact]
REGEX = (\d+/\d+/\d+[,]\d+:\d+:\d+)
FORMAT = end_time::$1
[split_end_time]
SOURCE_KEY=end_time
REGEX = (?<end_time_part1>\d+/\d+/\d+)[,](?<end_time_part2>\d+:\d+:\d+)
can you supply a couple of sample (redacted if necessary) events?