topic Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV? in Getting Data In

Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

Scan001 — Fri, 12 Jun 2015 10:41:08 GMT

i am trying to upload a csv file. When I set source to CSV, I get an error "unable to parse timestamp", defaulting to file modtime. There is a field called Timestamp with date format dd/mm/yy. I have tried multiple different file formats and setting the Timestamp options, nothing works. Can anyone advise how to resolve this?

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

richgalloway — Fri, 12 Jun 2015 12:59:34 GMT

Have you tried putting "%d/%m/%y" in the 'Timestamp format' box and also putting "Timestamp" in the "Specify all the fields which constitute the timestamp" box (all on the Timestamp tab of the Data Preview window)?

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

Scan001 — Fri, 12 Jun 2015 13:36:57 GMT

Hi richgalloway.
I tried the steps you suggested and I'm still having problems. After the import, the "Time" column is populated with todays date, for some reason it will not extract the date from my "date field". I have imported other data files without this issue arising. I will add the csv file I'm importing started as a sql file on a different machine.

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

richgalloway — Fri, 12 Jun 2015 13:40:17 GMT

I suspect there's something a little off in your CSV that is confusing Splunk. Can you share a few lines of it?

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

Scan001 — Fri, 12 Jun 2015 13:44:04 GMT

The following the first couple of lines of the file. (It has millions of events)

Thanks

When,EventID,ACT_Stamp,Event,Controller,Door,EventData,OriginalForename,OriginalSurname,
08/04/08,2,818806798,50,20,10,1896,Name,Name,
08/04/08,3,818806808,11,13,5,0,,,
08/04/08,4,818806827,50,15,3,4259,A8,,
08/04/08,5,818806843,11,13,5,0,,,
08/04/08,6,818806848,11,20,10,0,,,
08/04/08,7,818806873,50,20,5,6758,Name,Name,
08/04/08,8,818806876,11,13,5,0,,,
08/04/08,9,818806919,11,13,5,0,,,
08/04/08,10,818806920,50,15,4,4259,A8,,

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

richgalloway — Mon, 28 Sep 2020 20:13:45 GMT

I can reproduce the problem using your sample data. Assuming the dates are accurate, the problem appears to lie with the 7-year-old dates. Try adjusting your MAX_DAYS_AGO setting in props.conf.

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

Scan001 — Fri, 12 Jun 2015 14:04:00 GMT

I'm new to SPLUNK so I had to do a search for props.conf file and a number of files turn up. Which one do I change. is it /etc/users/admin/search/local/

Many thanks

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

Scan001 — Fri, 12 Jun 2015 14:59:53 GMT

I changed the variable in /etc/system/default/props.conf.

I get a error "failed to parse timestamp default to modtime"

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

Scan001 — Fri, 12 Jun 2015 14:59:53 GMT

I changed the variable in /etc/system/default/props.conf.

I get a error "failed to parse timestamp default to modtime"

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

richgalloway — Fri, 12 Jun 2015 16:23:00 GMT

One should never modify a file in a 'default' directory. You risk the changes getting lost the next time you upgrade Splunk. Instead, copy the relevant stanza to the same-named file in the 'local' directory and make your changes there. In your case, the etc/system/local/props.conf file should contain

[default]
max_days_ago = 2555

Splunk must be restarted for the changes to take effect.

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

Scan001 — Mon, 28 Sep 2020 20:15:51 GMT

I pasted that into the right file but I'm still have the same issues. Is there anything wrong here?

What I have in the file is:
[SampleR1_csv]
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = When
TIME_FORMAT = dd/mm/yy
TZ = Europe/Dublin
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true

[ csv ]
TIME_FORMAT=%Y %-m %-d %H %M %S
TIMESTAMP_FIELDS=YEAR,MONTH,DAY,HOUR,MINUTE,SECOND
SHOULD_LINEMERGE=false
INDEXED_EXTRACTIONS=csv
FIELD_DELIMITER=;
NO_BINARY_CHECK=true
KV_MODE=none
disabled=false
pulldown_type=true

[default]
max_days_ago = 2555

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

koshyk — Sat, 13 Jun 2015 19:55:19 GMT

have a look at answer:
http://answers.splunk.com/answers/2672/defining-timestamp-on-data-from-csv-file.html

Re: Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

richgalloway — Mon, 15 Jun 2015 11:20:56 GMT

Did you restart Splunk after editing the file? If you have a separate indexer, the file must be modified there and the indexer restarted.