Getting Data In

Can I modify _time with an attribute in the event?

pfabrizi
Path Finder

We are bringing in symatec DLP events and we want _time to have the value of occurred_on.

occurred_on comes in like this:

February 27, 2018 2:39pm

Can I do this as a TIME_FORMAT in props.conf or can I use a field-alias in props.conf?

Thanks!

0 Karma
1 Solution

mayurr98
Super Champion

Do this in props.conf

TIME_FORMAT = %B %d, %Y  %I:%M%p
TIME_PREFIX = occurred_on              //exact regex before time format

for example,if its coming occurred_on : "February 27, 2018 2:39pm" you should write TIME_PREFIX = occurred_on\s\:\s\"

Also this configuration will apply on latest events only i.e. from the time you do this configuration and restart the splunk server.
let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

Do this in props.conf

TIME_FORMAT = %B %d, %Y  %I:%M%p
TIME_PREFIX = occurred_on              //exact regex before time format

for example,if its coming occurred_on : "February 27, 2018 2:39pm" you should write TIME_PREFIX = occurred_on\s\:\s\"

Also this configuration will apply on latest events only i.e. from the time you do this configuration and restart the splunk server.
let me know if this helps!

0 Karma

pfabrizi
Path Finder

Thank You!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...