https://community.splunk.com/t5/Getting-Data-In/timestamp-event/m-p/61793#M12339 <P>There are many settings available in Splunk for <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps">setting timestamps</A>. For your case: First, identify the props.conf that you need to edit. If you aren't sure, you can create $SPLUNK_HOME/etc/system/local/props.conf. Try</P> <PRE><CODE>[source::/pathtoyoursource] MAX_TIMESTAMP_LOOKAHEAD = 0 </CODE></PRE> <P>By default, Splunk expects to see the timestamp in the first 150 characters of the event. This setting disables that, so Splunk will look all the way to the end of the event. There are other settings as well. For example, if you are trying to add older data, you might need to set <CODE>MAX_DAYS_AGO</CODE>.</P> <P>You might also want to add</P> <PRE><CODE>SHOULD_LINEMERGE=false </CODE></PRE> <P>if your CSV file is one line per event. This will speed up processing of your input, and may improve timestamp recognition.</P> <P>BTW, if you have control of the format of the CSV file, you could move the timestamp so it is the first column of the file. Splunk would process the input more efficiently.</P> Wed, 01 Feb 2012 22:05:58 GMT lguinn2 2012-02-01T22:05:58Z https://community.splunk.com/t5/Getting-Data-In/timestamp-event/m-p/61792#M12338 <P>Hi,</P> <P>I have already a date field on my CSV file but it isn't recognize.</P> <P>How I can help splunk to recognize this field to use as a timestamp ?</P> <P>My file :<BR /> ;"WIZARD_OR_SEARCH_NAME";"IDENTIFIER";"STATUS";"TEXT";"DATE"<BR /> ;"NULL";"NULL";"NULL";"ok";"NULL";"2011-10-19 04:39:14"</P> Mon, 28 Sep 2020 10:22:44 GMT https://community.splunk.com/t5/Getting-Data-In/timestamp-event/m-p/61792#M12338 gabriel94 2020-09-28T10:22:44Z https://community.splunk.com/t5/Getting-Data-In/timestamp-event/m-p/61793#M12339 <P>There are many settings available in Splunk for <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps">setting timestamps</A>. For your case: First, identify the props.conf that you need to edit. If you aren't sure, you can create $SPLUNK_HOME/etc/system/local/props.conf. Try</P> <PRE><CODE>[source::/pathtoyoursource] MAX_TIMESTAMP_LOOKAHEAD = 0 </CODE></PRE> <P>By default, Splunk expects to see the timestamp in the first 150 characters of the event. This setting disables that, so Splunk will look all the way to the end of the event. There are other settings as well. For example, if you are trying to add older data, you might need to set <CODE>MAX_DAYS_AGO</CODE>.</P> <P>You might also want to add</P> <PRE><CODE>SHOULD_LINEMERGE=false </CODE></PRE> <P>if your CSV file is one line per event. This will speed up processing of your input, and may improve timestamp recognition.</P> <P>BTW, if you have control of the format of the CSV file, you could move the timestamp so it is the first column of the file. Splunk would process the input more efficiently.</P> Wed, 01 Feb 2012 22:05:58 GMT https://community.splunk.com/t5/Getting-Data-In/timestamp-event/m-p/61793#M12339 lguinn2 2012-02-01T22:05:58Z