Splunk Search

How do you turn minute offset columns into timestamps?

gbronner_rbc
Explorer

I've got a csv file that looks like this:

Key, Description1, 0, 1,2, 3, 4, 5, 6,7,8,9,10
A , Description of A, value at midnight, value at 1201....

How does one turn this into a series of events of the form

_timestamp(1200), A, Description of A, value at midnight
_timestamp(1201),A, Description of A, value at 1201

etc...

0 Karma

somesoni2
Revered Legend

Try Something like this (might have to tweak the timestamp calculation

Your base search to get data from CSV | eval temp=Key."##".Description1 | fields - Key,Description1 | untable temp Timestamp Value | rex field=temp "(?<Key>.*)##(?<Description1>.*)" | fields - temp | eval Timestamp=now() + Timestamp*60 | convert ctime(Timestamp) | table Timestamp Keay Description Value
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...