transforms.conf INGEST_EVAL cannot get current time

[season88481]

Hi everyone,

I am trying to add a field for the current OS time. 

Here is my props.conf and transforms.conf

#props.conf
[mysourcetype]
TRANSFORMS-getdate = get-current-date

#transforms.conf
[get-current-date]
INGEST_EVAL = current_date=now()

But I have this error:

ERROR regexExtractionProcessor - Error compiling INGEST_EVAL expression for get-current-date: Bad function

Is it a bug?

Cheers,

S

[richgalloway]

I suspect it is not a bug. Submit feedback at https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/IngestEval requesting a list of allowed functions in INGEST_EVAL.
As a workaround, consider using the existing _index_time field in place of current_date.

[season88481 · Accepted solution]

Thanks richgalloway,

I found out using time() instead of now() can do the trick.

#props.conf
[mysourcetype]
TRANSFORMS-gettime = get-time-only

#transforms.conf
[get-time-only]
INGEST_EVAL = current_date=time()