https://community.splunk.com/t5/Getting-Data-In/Issue-with-csv-timestamp-extraction/m-p/61843#M12353 <P>Hey everyone. All of my input data comes into splunk in .csv format. Each line is a record, and it has numerous timestamps (CDR data). I need to extract the 14th field's timestamp.</P> <P>Here are the entries in my props.conf file:</P> <PRE><CODE>TIME_PREFIX=^([^,]*,){14} TIME_FORMAT=%Y%m%d%H%M%S.%q%Z </CODE></PRE> <P>I used the regex for the timestamp based on this post here:<BR /> <A href="http://splunk-base.splunk.com/answers/2062/how-can-i-extract-the-date-from-the-middle-of-an-event">http://splunk-base.splunk.com/answers/2062/how-can-i-extract-the-date-from-the-middle-of-an-event</A></P> <P>Any advice would be appreciated.</P> Mon, 22 Aug 2011 16:22:12 GMT msarro 2011-08-22T16:22:12Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-csv-timestamp-extraction/m-p/61843#M12353 <P>Hey everyone. All of my input data comes into splunk in .csv format. Each line is a record, and it has numerous timestamps (CDR data). I need to extract the 14th field's timestamp.</P> <P>Here are the entries in my props.conf file:</P> <PRE><CODE>TIME_PREFIX=^([^,]*,){14} TIME_FORMAT=%Y%m%d%H%M%S.%q%Z </CODE></PRE> <P>I used the regex for the timestamp based on this post here:<BR /> <A href="http://splunk-base.splunk.com/answers/2062/how-can-i-extract-the-date-from-the-middle-of-an-event">http://splunk-base.splunk.com/answers/2062/how-can-i-extract-the-date-from-the-middle-of-an-event</A></P> <P>Any advice would be appreciated.</P> Mon, 22 Aug 2011 16:22:12 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-csv-timestamp-extraction/m-p/61843#M12353 msarro 2011-08-22T16:22:12Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-csv-timestamp-extraction/m-p/61844#M12354 <P>Figured it out, I was looking one field too far forward. Thanks to everyone who looked for me!</P> Mon, 22 Aug 2011 17:03:24 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-csv-timestamp-extraction/m-p/61844#M12354 msarro 2011-08-22T17:03:24Z