I am having issues with breaking a timestamp field into its components.
Currently the field is in the format of: 2015-04-14 19:25:21
I need the data to be in separate fields: *Year, month, day, hour, minute *
I have tried variations on eval using strptime, strftime, and have looked at using a REX on it, however, I am not making progress.
This will be a heavily used set of fields, so I would prefer to get this into my props file rather than being a searchtime action. My current props.conf is:
[csv-cdr] CHECK_FOR_HEADER = false KV_MODE = auto NO_BINARY_CHECK = 1 LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = False pulldown_type = 1 FIELD_DELIMITER = , FIELD_NAMES = [ clid,src,dst,dcontext,channel,dstchannel,lastapp,lastdata,start,answer,end,duration,billsec,disposition,amaflags,accountcode,unique id,userfield,peeraccount,linkedid,sequence
This regex should extract the parts you want.
Hi Rich. Great - that worked perfectly.
How would I go about incorporating that in an index time thing.... I guess that props or transforms but not sure which or how.