Hi @ranandeshi I've posted an updated SPL directly on the question, but you can make this a single EVAL with: | eval formatted_time = strftime((tonumber(substr(identifier,2,16),16) - tonumber("4000000000000000",16) + tonumber(substr(identifier,18,8),16) / 1000000000), "%Y-%m-%d %H:%M:%S") . "." . printf("%03d", round(tonumber(substr(identifier,18,8),16) / 1000000, 0)) This means you could possible use INGEST_EVAL to overwrite the _time field: == props.conf ==
[yourSourcetype]
TRANSFORMS-taiTime = taiTimeExtract
== transforms.conf ==
[taiTimeExtract]
INGEST_EVAL = _time:=strftime((tonumber(substr(identifier,2,16),16) - tonumber("4000000000000000",16) + tonumber(substr(identifier,18,8),16) / 1000000000), "%Y-%m-%d %H:%M:%S") . "." . printf("%03d", round(tonumber(substr(identifier,18,8),16) / 1000000, 0)) However this assumes "identifier" is a field it can eval against. You might need to extract this first. Do you have a sample event I can work on to help or is this enough to get you started? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
... View more