I have an event like
"abcabcabc....abc..timestamp:-2017-05-05T*08:08:08.987.....abc...abc.....date:-2017-05-03*......""
I need to assign _time where date should be extracted from date field and time value should be extracted from timestamp field.
Is there any possibility.
If I need to use datatime_renamed.xml , where I should place this new resulting file. Does this effect existing settings on other indexes.
| rex "(?<time>\d{2}:\d{2}:\d{2}\.\d{3})"
| rex "date:-(?<date>\d{4}-\d{2}-\d{2})"
| eval datetime=strftime(date."T".time, "%FT%T.%3N")
| table datetime
Beautiful,
regarding the second part of the question, @jkat54 used the erx command to extract the timeestamp which means its at search time. it will not affect other settings