SNC Cribl MCP

{ "id": "auto_timestamp", "schema": { "type": "object", "title": "", "additionalProperties": false, "properties": { "srcField": { "title": "Source field", "description": "Field to search for a timestamp", "type": "string", "default": "_raw" }, "dstField": { "title": "Destination field", "description": "Field to place timestamp in", "type": "string", "default": "_time" }, "defaultTimezone": { "type": "string", "title": "Default timezone", "description": "Timezone to assign to timestamps without timezone info", "default": "local" }, "timeExpression": { "title": "Time expression", "description": "Expression to use to format time. Current time, as a JavaScript Date object, is in global `time`. You can access other fields' values via __e.<fieldName>.", "type": "string", "jsExpression": true, "default": "time.getTime() / 1000" }, "offset": { "title": "Start scan offset", "description": "The offset into the string from which to look for a timestamp", "type": "number", "minimum": 0, "default": 0 }, "maxLen": { "title": "Max timestamp scan depth", "description": "Maximum string length at which to look for a timestamp", "type": "number", "minimum": 1, "default": 150 }, "defaultTime": { "title": "Default time", "description": "How to set the time field if no timestamp is found", "type": "string", "default": "now", "enum": ["now", "last", "none"], "enumNames": ["Current Time", "Last Event's Time", "None"] }, "latestDateAllowed": { "title": "Future timestamp allowed", "description": "The latest timestamp value allowed relative to now, such as +42days. Parsed values after this date will be set to the Default time.", "type": "string", "default": "+1week", "absoluteRelativeTime": true }, "spacer": { "type": "string" }, "earliestDateAllowed": { "title": "Earliest timestamp allowed", "description": "The earliest timestamp value allowed relative to now, such as -42years. Parsed values prior to this date will be set to the Default time.", "type": "string", "default": "-420weeks", "absoluteRelativeTime": true, "absoluteRelativeEarliestTime": "latestDateAllowed" }, "timestamps": { "title": "Additional timestamps", "description": "Add regex/strptime pairs to extract additional timestamp formats", "type": "array", "items": { "type": "object", "required": ["regex", "strptime"], "properties": { "regex": { "type": "string", "title": "Regex", "description": "Regex with first capturing group matching the timestamp", "regexp": true }, "strptime": { "type": "string", "title": "Strptime format", "description": "Select or enter strptime format for the captured timestamp" } } } } } } }