@cherrypick SPL with Dummy Data Using makeresults | makeresults count=10 | streamstats count as id | eval raw_json=case( id=1, "{\"date\": \"2025-05-23 9:35:35 PM\", \"event\": \"Login\"}", id...
See more...
@cherrypick SPL with Dummy Data Using makeresults | makeresults count=10 | streamstats count as id | eval raw_json=case( id=1, "{\"date\": \"2025-05-23 9:35:35 PM\", \"event\": \"Login\"}", id=2, "{\"date\": \"2025-05-23\", \"event\": \"Logout\"}", id=3, "{\"date\": \"2025-05-24 10:15:00 AM\", \"event\": \"Login\"}", id=4, "{\"date\": \"2025-05-24\", \"event\": \"Logout\"}", id=5, "{\"date\": \"2025-05-25 11:45:00 AM\", \"event\": \"Update\"}", id=6, "{\"date\": \"2025-05-25\", \"event\": \"Login\"}", id=7, "{\"date\": \"2025-05-26 12:00:00 PM\", \"event\": \"Logout\"}", id=8, "{\"date\": \"2025-05-26\", \"event\": \"Update\"}", id=9, "{\"date\": \"2025-05-27 1:30:00 PM\", \"event\": \"Login\"}", id=10, "{\"date\": \"2025-05-27\", \"event\": \"Logout\"}" ) | spath input=raw_json | eval parsed_time = if(match(date, "\\d{4}-\\d{2}-\\d{2} \\d{1,2}:\\d{2}:\\d{2} [APMapm]{2}"), strptime(date, "%Y-%m-%d %I:%M:%S %p"), strptime(date, "%Y-%m-%d")) | eval _time = parsed_time | table _time, date, event | makeresults count=4 | streamstats count AS row | eval _raw=case( row=1, "{\"date\":\"2025-05-23 21:35:35\"}", row=2, "{\"date\":\"2025-05-22\"}", row=3, "{\"date\":\"2025-05-21 15:20:00\"}", row=4, "{\"date\":\"2025-05-20\"}" ) | spath | eval _time=if(match(date, "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}"), strptime(date, "%Y-%m-%d %H:%M:%S"), strptime(date, "%Y-%m-%d")) | table date _time