Any suggestions on the format that I could use to extract this timestamp?
#Fri Aug 31 14:37:21 2012
thanks,
James
Hi
Check this
| makeresults
| eval temp="#Fri Aug 31 14:37:21 2012"
| eval epoch =strptime(temp,"#%a %b %d %H:%M:%S %Y")
| eval result = strftime(epoch,"%d/%m/%Y %H:%M:%S")
Hi
Check this
| makeresults
| eval temp="#Fri Aug 31 14:37:21 2012"
| eval epoch =strptime(temp,"#%a %b %d %H:%M:%S %Y")
| eval result = strftime(epoch,"%d/%m/%Y %H:%M:%S")
thanks, works great inline
Also, for sourcetype, I used TIME_PREFIX=#