https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-timestamp-from-multi-timestamp-csv-file/m-p/152427#M31036 <P>Need help, i have log file kind of:<BR /> "INT","INT","INT","VARCHAR","""VARCHAR"" <INT>","VARCHAR","VARCHAR","VARCHAR",VARCHAR,,,VARCHAR,VARCHAR,"2013-09-19 09:29:53","2013-09-19 09:29:55","2013-09-19 09:34:50",297,295,VARCHAR,VARCHAR,"1379597393.479905",""</INT></P> <P>i neet to set my timestamp as first time field: "2013-09-19 09:29:53" is there any way to tell on what position my timestamp?? Or maybe any other way to do this? Previous field is not good idea to regexp, because it can be string with digits in any order and with any legth.<BR /> Thank you!</P> Fri, 22 Nov 2013 16:47:17 GMT sarumjanuch 2013-11-22T16:47:17Z https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-timestamp-from-multi-timestamp-csv-file/m-p/152427#M31036 <P>Need help, i have log file kind of:<BR /> "INT","INT","INT","VARCHAR","""VARCHAR"" <INT>","VARCHAR","VARCHAR","VARCHAR",VARCHAR,,,VARCHAR,VARCHAR,"2013-09-19 09:29:53","2013-09-19 09:29:55","2013-09-19 09:34:50",297,295,VARCHAR,VARCHAR,"1379597393.479905",""</INT></P> <P>i neet to set my timestamp as first time field: "2013-09-19 09:29:53" is there any way to tell on what position my timestamp?? Or maybe any other way to do this? Previous field is not good idea to regexp, because it can be string with digits in any order and with any legth.<BR /> Thank you!</P> Fri, 22 Nov 2013 16:47:17 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-timestamp-from-multi-timestamp-csv-file/m-p/152427#M31036 sarumjanuch 2013-11-22T16:47:17Z https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-timestamp-from-multi-timestamp-csv-file/m-p/152428#M31037 <P>Finaly found resolution: <BR /> TIME_PREFIX=^([^,]*,){Position of needed field}</P> Fri, 22 Nov 2013 18:18:14 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-extract-timestamp-from-multi-timestamp-csv-file/m-p/152428#M31037 sarumjanuch 2013-11-22T18:18:14Z