I am trying to configure the Auto Timestamp function to extract a time field

Franky Laarits · September 2023

hi all, I am trying to configure the Auto Timestamp function to extract a time field that can be all over the place within the event. The timestamp itself is in epoch format (start=<time>). I setup an additional timestamp within the function, but I'm not sure what to specify for a strptime format, since it's epoch.

David Maislin · September 2023

%s

Oliver Hoppe · September 2023

just for reference, those linke are quite handy. https://docs.cribl.io/stream/cribl-reference/#time https://github.com/d3/d3-time-format#api-reference

I am trying to configure the Auto Timestamp function to extract a time field

Answers

Categories