Splunk Search

Need to change the _time to log event time

rashi83
Explorer

Hi ,

I need to replace value of _time with special extracted log time event. I am using this search but its not working . 

Log event  : 20200625_22:44:35.090 (thread=1): User ID: xxxx

....| rex field=_raw "^(?P<newtime>[^ ]+)" | eval newtime =strptime(newtime, "%m/%d/%Y") | eval _time = 'newtime' | table newtime _time

 

I am trying to capture the time "20200625_22:44:35.090" in newtime and put this value in _time

 

Please help 

 

Labels (1)
0 Karma

anilchaithu
Builder

@rashi83 

I guess its with extracted time format & strptime function. Please try this

eval newtime =strptime(newtime,"%Y%m%d_%H:%M%:%S.%3N)

 

Hope this helps

0 Karma

rashi83
Explorer

Saying invalid arguments in srptime function.

0 Karma