topic Re: Extract timestamp when there is only a year and month in Getting Data In

Extract timestamp when there is only a year and month

SquarePeg — Thu, 14 Oct 2021 10:57:51 GMT

I've got a csv file where the first line contains the field names and the rest are separate events but the first column is year and the second is month. There are no other time-based fields i.e. day, hour, etc so I am having difficulty in creating a _time field.

Does anyone know how I can generate a _time field using only year and month? The day, hour, etc are irrelevant.

Thanks in advance

Re: Extract timestamp when there is only a year and month

richgalloway — Thu, 14 Oct 2021 15:31:46 GMT

Have you tried something like this in props.conf?

[mysourcetype] TIMESTAMP_FIELDS = year,month TIME_FORMAT = %Y,%m

Re: Extract timestamp when there is only a year and month

SquarePeg — Mon, 18 Oct 2021 08:49:11 GMT

Yes, it doesn't recognise it because it isn't a full date format