<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Failed to parse timestamp in psv file in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693216#M115232</link>
    <description>&lt;P&gt;It ended up being the time format was wrong.&amp;nbsp; I had the month and day swapped.&amp;nbsp; Thanks all for chiming in.&lt;/P&gt;</description>
    <pubDate>Fri, 12 Jul 2024 19:36:51 GMT</pubDate>
    <dc:creator>the_sigma</dc:creator>
    <dc:date>2024-07-12T19:36:51Z</dc:date>
    <item>
      <title>Failed to parse timestamp in psv file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693129#M115224</link>
      <description>&lt;P&gt;I have the following pipe separated value file that I am having problems onboarding.&amp;nbsp; The first row is the column headers. Second row is sample data.&amp;nbsp; I'm getting an error when attempting to use the CREA_TS column as the timestamps&lt;/P&gt;
&lt;TABLE width="448"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="448"&gt;CREA_TS|ACTION|PRSN_ADDR_AUDT_ID|PRSN_ADDR_ID|PRSN_ID|SRC_ID&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD&gt;07102024070808|INSERT|165713232|147994550|101394986|OLASFL&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;This is what I have for props but I cannot get it to identify the timestamp.&amp;nbsp; &amp;nbsp;Any help will be greatly appreciated.&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;[ psv ]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
description=Pipe-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
LINE_BREAKER=([\r\n]+)
TIMESTAMP_FIELDS=CREA_TS
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=14&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 12 Jul 2024 22:35:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693129#M115224</guid>
      <dc:creator>the_sigma</dc:creator>
      <dc:date>2024-07-12T22:35:37Z</dc:date>
    </item>
    <item>
      <title>Re: Failed to parse timestamp in psv file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693144#M115225</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/260755"&gt;@the_sigma&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;the props.conf seems to be ok, what's the issue you have?&lt;/P&gt;&lt;P&gt;the only thing is that&amp;nbsp;I don't see the TIME_FORMAT field.&lt;/P&gt;&lt;P&gt;try saving a copy of your data in a text file and adding it using the Add data function: in this way you can test your extraction and eventual updates.&lt;/P&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 12 Jul 2024 06:46:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693144#M115225</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2024-07-12T06:46:03Z</dc:date>
    </item>
    <item>
      <title>Re: Failed to parse timestamp in psv file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693163#M115228</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/260755"&gt;@the_sigma&lt;/a&gt;,&lt;BR /&gt;&lt;BR /&gt;Try these configs:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;[ psv ]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=PSV
SHOULD_LINEMERGE=false
category=Structured
description=Pipe-separated value format.
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=14
TIME_FORMAT=%d%m%Y%H%M%S&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 12 Jul 2024 09:06:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693163#M115228</guid>
      <dc:creator>manjunathmeti</dc:creator>
      <dc:date>2024-07-12T09:06:48Z</dc:date>
    </item>
    <item>
      <title>Re: Failed to parse timestamp in psv file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693171#M115229</link>
      <description>&lt;P&gt;I think the time format is more likely to be&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;TIME_FORMAT=%m%d%Y%H%M%S&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 12 Jul 2024 09:25:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693171#M115229</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-07-12T09:25:31Z</dc:date>
    </item>
    <item>
      <title>Re: Failed to parse timestamp in psv file</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693216#M115232</link>
      <description>&lt;P&gt;It ended up being the time format was wrong.&amp;nbsp; I had the month and day swapped.&amp;nbsp; Thanks all for chiming in.&lt;/P&gt;</description>
      <pubDate>Fri, 12 Jul 2024 19:36:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-timestamp-in-psv-file/m-p/693216#M115232</guid>
      <dc:creator>the_sigma</dc:creator>
      <dc:date>2024-07-12T19:36:51Z</dc:date>
    </item>
  </channel>
</rss>

