Closed l3fdb33f closed 9 months ago
Hi l3fdb33f,
I'm not sure if I understand the issue,
--multi-timestamp
iterates over all datetime fields per record and duplicates this in the ts
field, and ts_description
is set to denote which field the ts
is from.
In your example output you see the last timestamp is of the regf_modification_time
, the first three records that have ts=None
are of:
creation_time
modification_time
access_time
However they are None
in the original record, so ts
is also None
.
How are you selecting events? if you are using a rdump selector a common way to filter out None
fields is to do something like this:
$ rdump windows_shellbag.jsonl --multi-timestamp -w - | rdump -s 'r.ts' -L
This ensures that only records that only "truthy" ts
fields are selected, effectively discarding ts=None
values.
Ah I see! This is my misunderstanding then; I didn't understand it was normal behavior for there to be events with timestamp None as a result of the process. I will filter these and it looks like no data is lost. Thank you!
Do note that if you happen to come across a record with no timestamps at all (all None
) you will lose all reference to that data!
I noticed when working with the shellbags function in particular that sometimes the regf_modification_time timestamp does not get placed into the "ts" field after piping to rdump and using the --multi-timestamp option:
This has unfortunate effects when seeking to select events using the r.ts field, as it is None. Here's the source data I'm using, as .jsonl: windows_shellbag.zip
Thanks in advance!