https://community.splunk.com/t5/Getting-Data-In/CSV-fields-and-multiple-timestamps/m-p/55964#M10941 <P>Never mind - I found the answer here. </P> <P><A href="http://answers.splunk.com/questions/2062/how-can-i-extract-the-date-from-the-middle-of-an-event" rel="nofollow">http://answers.splunk.com/questions/2062/how-can-i-extract-the-date-from-the-middle-of-an-event</A></P> Wed, 09 Mar 2011 03:48:09 GMT rasingh 2011-03-09T03:48:09Z https://community.splunk.com/t5/Getting-Data-In/CSV-fields-and-multiple-timestamps/m-p/55963#M10940 <P>I have a csv tab-delimited file with entries that looks like this:</P> <PRE><CODE>GPDB20A LTO3 L03 03/08/11 06:01:20 1299592880 03/08/11 08:09:46 1299600586 </CODE></PRE> <P>I want to grab the 4th field timestamp. With no TIME_PREFIX, it grabs the timestamp from the second field. When I use the TIME_PREFIX below, it uses the time that the event was indexed:</P> <PRE><CODE>TIME_PREFIX = (?i)^(?:[^\t]*\t){3} </CODE></PRE> <P>I got that regex from the field extractor in the GUI. </P> <P>Any ideas, please?</P> Wed, 09 Mar 2011 03:43:08 GMT https://community.splunk.com/t5/Getting-Data-In/CSV-fields-and-multiple-timestamps/m-p/55963#M10940 rasingh 2011-03-09T03:43:08Z https://community.splunk.com/t5/Getting-Data-In/CSV-fields-and-multiple-timestamps/m-p/55964#M10941 <P>Never mind - I found the answer here. </P> <P><A href="http://answers.splunk.com/questions/2062/how-can-i-extract-the-date-from-the-middle-of-an-event" rel="nofollow">http://answers.splunk.com/questions/2062/how-can-i-extract-the-date-from-the-middle-of-an-event</A></P> Wed, 09 Mar 2011 03:48:09 GMT https://community.splunk.com/t5/Getting-Data-In/CSV-fields-and-multiple-timestamps/m-p/55964#M10941 rasingh 2011-03-09T03:48:09Z