I could find issues with the following UDS Utility Functions,
1. EVNTTIME
2. UTC - (Coordinated Universal Time, formerly known as Greenwich Mean Time)
Sample Log Event - (In Syslog Format) :
Oct 27 00:45:29 [172.22.24.223] Oct 27 00:45:29 testing140 Ipauth123: 5010 testing140 Ipauthentication successful for user:tsg_pol_intl_user ip:179.212.48.114 network:campus url-channel:CAMPUS
In the sample Log Event, the timestamp Oct 27 00:45:29 - has only the month, day, and the time; it does not have the year part in it.
It is provided in the user guide document that, we need to use MDTS Function for such cases of timestamp ( Oct 27 00:45:29 ). In the case of MDTS Function, the DATE/TIME field of the enVision table will be populated with the actual Event Time stamp and this also works fine for me.
But my scenario is that i need both Collector's Timestamp in the DATE / TIME column of the enVision table and Actual Event's Timestamp in the Event_Time column of the enVision table.
So, I used the following command to store the Actual Event's Timestamp in the event_time column of the table,
1. <@event_time:*EVNTTIME($HDR,'%B %D %H:%T:%S',month,day,time)>
The function worked but in the event_time column of the enVision table i am getting garbage value in the year part , i.e. i get 1969 instead of 2010 and other part of the timestamp occurred as expected but only the year part which was not in the timestamp is having the value 1969 instead of 2010.
I have also tried executing the UTC utility function but i get the year part with the value of 1969 instead of 2010.
The description of the UTC command (from the UDS Support Guide) states that,
"If a year value is available in the format string, this value will be used by the UTC command. If a year
value is not available, as in this example, the year value associated with the receive time of the message is
used".
But this is not working as expected. Please let me know what needs to be done.
