Splunk Search

transforms.conf INGEST_EVAL cannot get current time

season88481
Contributor

Hi everyone,

 

I am trying to add a field for the current OS time. 

 

Here is my props.conf and transforms.conf

 

#props.conf
[mysourcetype]
TRANSFORMS-getdate = get-current-date
#transforms.conf
[get-current-date]
INGEST_EVAL = current_date=now()

 

 

But I have this error:

 

ERROR regexExtractionProcessor - Error compiling INGEST_EVAL expression for get-current-date: Bad function

 

 

Is it a bug?

 

Cheers,

S

Labels (1)
0 Karma
1 Solution

season88481
Contributor

Thanks richgalloway,

 

I found out using time() instead of now() can do the trick.

#props.conf
[mysourcetype]
TRANSFORMS-gettime = get-time-only

 

#transforms.conf
[get-time-only]
INGEST_EVAL = current_date=time()

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
I suspect it is not a bug. Submit feedback at https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/IngestEval requesting a list of allowed functions in INGEST_EVAL.
As a workaround, consider using the existing _index_time field in place of current_date.
---
If this reply helps you, Karma would be appreciated.

season88481
Contributor

Thanks richgalloway,

 

I found out using time() instead of now() can do the trick.

#props.conf
[mysourcetype]
TRANSFORMS-gettime = get-time-only

 

#transforms.conf
[get-time-only]
INGEST_EVAL = current_date=time()
Get Updates on the Splunk Community!

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...