- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
UDS Utility for splitting a value
HI,
Does anyone know if there is any function that can be used to split a value into two fields. For example , we have tje timestamp as Sep17 in the event payload. How do we pass this parameter to the eventtime function ? Since there is no space between the month and day , is it possible to split the value using any utility ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
EVNTTIME function will only accept 3 characters for the month. try as follows and see if this works for you?
<@event_time:*EVNTTIME($MSG,'%B%F %W %N:%U:%O',fld20,fld21,fld22)>should parseSep22 2009 18:16:55 correctly like:<event_time:*EVNTTIME:*EVNTTIME($MSG,'%B%F %W %N:%U:%O',fld20,fld21,fld22)> : 2009-09-22 18:16:55 - from the UDS parse command
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
BTW if you speak about Time splitting, how can i manage TIME with milliseconds ?
I got logs with this format : 20091201:090545.231
Regards
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Put a variable for them at the end after the decimal point.
<date>:<time>.<ms>
There is currently no device timestamp parameter available to read in the millisecond value, though.
