Sorry about that, these are more reports than alerts.  These reports send an email at a scheduled time of the day.  Some work and some do not work.  I've looked at the Job Manager and these reports have been executed but some were not sent while others are sent. ... View more

I added this in the props.conf and it converted the _raw data and _time data along with the regex in the transforms.conf. props.conf TIME_FORMAT = %d/%m/%y %H:%M:%S transforms.conf REGEX = ^(\d{2})\/(\d{2})\/(\d{2})\s(.*) FORMAT = $2/$1/$3 $4 TIME_FORMAT = %d/%m/%y %H:%M:%S ... View more

Thank you for the input, but how do I get the date resorted to where it's in the raw data and _time? ... View more

These two rows will process to _raw data, but not to _time data. 02/04/19 12:50:49,userid,Processing,REV,10,,Dimension 2 Code,Modification,2024,2024,2033,2033 05/04/19 06:19:26,userid,Account,000000,,,Last Date Modified,Modification,2018-11-05,11/05/18,2019-04-05,04/05/19 These two rows have the same date, the second row will process to _raw data and to _time data. The first row is where I get the error mentioned earlier to _raw data, but for _time data it reverts back to the previous record and converts the _time to 05/04/19. 11/04/19 09:08:30,userid,General,,,,Allow From,Modification,2019-03-01,03/01/19,2019-04-01,04/01/19 11/04/19 09:08:30,userid,General Setup,,,,Allow To,Modification,2019-04-30,04/30/19,2019-05-01,05/01/19 ... View more

This setting in the transform config file will convert the date to what I need in the raw data. REGEX = ^(\d{2})\/(\d{2})\/(\d{2})\s([^/]+) FORMAT = $2/$1/$3 $4 But, when I add the data and on the create sourcetype page to check the data, switch to raw data only the date will show and not the rest of the raw data. I think you are right, it has something to do with the regex. ... View more

I checked and all dates and times are in the same format. The regex is changing the actual raw data for the dates. So that's working. It just that some dates are converting over to the _time to where I can do a search on these dates. I have about 30 records that are not converting over to the _time. Maybe this is causing the issue with the dates converting to _time. On one record the file date is 11/04/19, the raw data is 04/11/19, but the _time data is 5/4/19 with this error. A possible timestamp match (Mon Nov 4 09:08:30 2019) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD(17) characters of event. Defaulting to timestamp of previous event(Sat May 4 06:19:26 2019). It's very strange, because the record right after the one listed above has the exact same date and time and the _raw data and _time data works. That's just one example, another example is on one record the file date is 02/04/19, the raw data is 04/02/19, but the _time data is 2/4/19. ... View more

This is what I have now, it's strange it works somewhat. It will resort the data on some but not all of them for the month. Once I do a search between dates, it will not display all records for that month because some dates were not resorted. Any ideas? [sourcetype] TRANSFORMS-sortdate = resortdate FIELD_DELIMITER = , NO_BINARY_CHECK = true TIMESTAMP_FIELDS = Date and Time category = Custom disabled = false [resortdate] REGEX = ^(\d{2})\/(\d{2})\/(\d{2})\s([^/]+) FORMAT = $2/$1/$3 $4 DEST_KEY = _raw ... View more

Sorry about that, I placed my info into the wrong area. Below is what I have so far. props.conf [sourcetype] FIELD_DELIMITER = , INDEXED_EXTRACTIONS = csv TRANSFORMS-sortdate = resortdate transform.conf [resortdate] REGEX = ^(\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}) FORMAT = $2/$1/$3 DEST_KEY = _raw This is what I have to convert the raw data to a better date format like mm/dd/yyyy. What am I missing? ... View more

props.conf [sourcetype] FIELD_DELIMITER = , INDEXED_EXTRACTIONS = csv TRANSFORMS-sortdate = resortdate transform.conf [resortdate] REGEX = ^(\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}) FORMAT = $2/$1/$3 DEST_KEY = _raw This is what I have to convert the raw data to a better date format like mm/dd/yyyy. What am I missing? ... View more

This answer worked for the leading zero. Thank you. ... View more

That works, for the dates that MMDDYY and I did not mention that some of the date do not have a 0 in front of the month. For example: September is 9 instead of 09. This query will only for months with two digits. Any other ideas? ... View more