topic Re: Splunk Set Source Type format Timestamp strptime field examples in Getting Data In

Splunk Set Source Type format Timestamp strptime field examples

bogdan_nicolesc — Thu, 23 Sep 2021 22:23:43 GMT

Hi all,

I'm trying hard to add data into Splunk from a .csv file instead of .json. I managed to convert it from .json to .csv and now, when i try to alter <Timestamp format > using strptime() is showing me time from the adding time, not the time from the field time inside the .csv that is in Epoch Unix Timestamp.

I have read this resource, https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/Data/Configuretimestamprecognition

but to no avail ...

Please advice ...

Re: Splunk Set Source Type format Timestamp strptime field examples

ITWhisperer — Fri, 24 Sep 2021 06:39:23 GMT

Please share and example of the csv and the configuration you are using to ingest it

Re: Splunk Set Source Type format Timestamp strptime field examples

bogdan_nicolesc — Fri, 24 Sep 2021 07:22:51 GMT

As you can clearly see, in the first photo is my .csv field setup with times resembling as 1632177107637870.

The second photo, is how i want to import it.