Event data has multiple time values in the Epoch time format. I am able to convert the one used for event timestamp without issue. Having trouble with the eval statements in props.conf to convert the additional fields to a human-readable time for indexing.
example of times in the event (referenced as time.event, time.receive, and time.report)
example of EVAL statements
eval
considers the dot to be a concatenation operator, use strptime('time.report', "...")
- the single quotes will tell eval
"this is a field name, even if it contains operators and other non-standard characters".
eval
considers the dot to be a concatenation operator, use strptime('time.report', "...")
- the single quotes will tell eval
"this is a field name, even if it contains operators and other non-standard characters".
eureka! knew it was something small I was missing. changed it to strftime to work correctly.
Right, strftime 🙂
For posterity and future generations of googlers, this is search time, not index time.