My csv data contains a number of timestamps. I want the timestamp field to be conditional on the result of another field, say field 12. So if I compare field 12 in each row for "X" then I want to use the timestamp from field 15th and if field 12 contains "Y", I want to use field 10 for the timestamp.
Currently I am splitting my log file into two based on the field 12 value and then defining 2 different sourcetypes, each with a different TIME_PREFIX value in props.conf, but wondered if I could avoid that step and have a single sourcetype.
Following Ayn and Kristian Kolb's comments, here's more detail
These are the two standard lines of data
Course A,_scorm12_ar123,Custom Asset,username1,First,Last,Branch Sales,Group Id1,Group Path,0,2013-11-07,2013-11-07,2,0,,,In Progress,,,,35,14,Direct sales
Course B,_scorm12_cf411,Custom Asset,username2,First,Last,Group name,Group Id2,Group Path2,0,2013-11-16,2013-11-20,3,0,,2013-11-17,Completed,,100.00,100.00,35,62,Indirect sales
The first is a course in progress (field 17) and started on 2013-11-07 (field 11)
The second is a course completed (field 17) and started on 2013-11-16 (field 11) and completed on 2013-11-17 (field 16).
I tried two TIME_PREFIX settings
TIME_PREFIX=^(((\"[^\"]*\",)|([^,]*,)){15}|((\"[^\"]*\",)|([^,]*,)){10})
TIME_PREFIX=^(((\"[^\"]*\",)|([^,]*,)){10}|((\"[^\"]*\",)|([^,]*,)){15})
In the first case, _time is set to the completion date or the 'previous' record's time if the course in In Progress. In the second case, the _time is always set to the start date.
I don't suppose I can look ahead BEYOND the wanted time field to check for the value of field 17 to then extract the time from a field BEFORE...??
I guess if the Completed|In Progress text was before the time field I could include that in the pattern, but the docs for TIME_PREFIX say the time is extracted from the text following the regex match.
... View more