Can you extract date fields to use them in a search?

[SalimRahmani]

Hello,

I'm receiving syslog data stream on UDP port 514. The event is:

Jul 17 15:32:00 salim-VPCEB1E1E SplunkNetflowApp.py[20084]: af= 2 first= 2010-04-15 05:44:19 last= 1970-01-01 00:00:00 proto= udp srcip= 10.0.1.6 srcport= 2104 dstip= 10.0.4.6 dstport= 456 srcas= 2 dstas= 3 input= 3 output= 5 flags= 0 tos= 80 dscp= 20 packets= 1 bytes= 64

Using the configuration files, I could extract the fields. However, first and last are extracted as Strings though they are DateTime types. Please does Splunk enable you to extract these as dates so that you can use them in search?

Thanks in advance,

[davebrooking · Accepted solution]

You could use an EVAL clause in props.conf to achieve this. Something like

EVAL-firstdate = strptime(first,"%Y-%m-%d %H:%M:%S")

[davebrooking]

The strptime function takes a string and turns it into an epoch time, which is the number of seconds since 1st January 1970. So 2010-04-15 05:44:19 converts to 1271310259.

When you say the last date didn't work, did it produce a new field? I would expect a new field with a value of 0 using the example event provided.

If no field was produced can you post the appropriate contents of the props.conf

[SalimRahmani]

Thank you guys for your awesome replies! Though I have small questions. I tried the expression and it worked. I mean when I say it worked it created a new field called firstdate however it is: a NUMBER??!!! (weird!) The second thing is that I've done the same thing for the last which is kinda the SAME thing but it didn't work at all! Any insight ?! :$ Thanks!!!

[davebrooking]

somesoni2,

Thanks for adding the reference I usually try to do that when answering customers, but was extremely lazy in this answer.

Dave

[somesoni2]

More details here.

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/definecalcfields