Timestamp Problem

ctmoses — Mon, 28 Sep 2020 14:42:56 GMT

My data is formatted in a CSV file with only two kinds of data:

"Time: 7/4/2012, 213"

The columns are the date of an event and a related count type to the event. I have 1014 rows of data.

With that in mind, I set my props.conf to the following:
TIME_PREFIX= Time:
TIME_FORMAT= %m/%d/%Y

When I do this Splunk recognizes the date and sets the time stamp appropriately. However, when I access the data in a search, it uses the ingest date/time as the _time rather that the time stamp that was established when I manually set up the data input. Am I missing some key to keeping the time stamp recognition?

Re: Timestamp Problem

ctmoses — Thu, 05 Sep 2013 17:11:56 GMT

While I couldn't solve the problem of getting Splunk to recognize my original regex as _time, I was able to get around by using field extraction to get my date from the data and (as "Date")then using
...|eval _time= strptime(Date, "%m/%d/%Y")

Still don't understand why Splunk recognized the time stamp when I was setting up this file as new data but did not search it the same way...

topic Timestamp Problem in Getting Data In

Timestamp Problem

Re: Timestamp Problem