I have events that are coming in with no timestamp except for a field "event_sec" which gives me the time in epoch format. Is there a way to use the props.conf to convert these all to the timestamp for the events? An example of the first couple fields in the event are:
rec_type=500 rec_type_simple="FILELOG EVENT" event_sec=1453991513
Where as i would like to take the event_sec field and convert it to human readable date/time using the props.conf
Hi
This sourcetype should have this configuration
[mysourcetype ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%s
TIME_PREFIX=event_sec=
You can do more formatting at search time later on.
Please mark as answered if this is what you were looking for.
j
Hi
This sourcetype should have this configuration
[mysourcetype ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%s
TIME_PREFIX=event_sec=
You can do more formatting at search time later on.
Please mark as answered if this is what you were looking for.
j