topic Re: could not use strptime to parse timestamp - csv file in Getting Data In

could not use strptime to parse timestamp - csv file

smudge797 — Mon, 28 Sep 2020 19:43:24 GMT

Having issue importing csv, the Data format looks like this in CSV:

,Transactions,,,,,,,,
,XXXX XXXX XXXX 7282: ,,30/10/2014 to 30/04/2015,,,,,,
,,,,,,,,,
,Date,,Description,,Money in,Money Out,Balance,,
,,,,,,,,,
,30/04/2015,,"CARD PAYMENT TO SPOTIFY SPOTIFY PREMIU,9.99 GBP, RATE 1.00/GBP ON 28-04-2015",,,_9.99,"_1,579.75",,
,29/04/2015,,"CARD PAYMENT TO THE SOUTHERN CO-OP,4.95 GBP, RATE 1.00/GBP ON 27-04-2015",,,_4.95,"_1,589.74",,
,28/04/2015,,"CARD PAYMENT TO HOMEBASE LTD 107,34.99 GBP, RATE 1.00/GBP ON 25-04-2015",,,_34.99,"_1,594.69",,

Im using TIME_FORMAT = %d/%m/%y and im seeing error:
could not use the strptime to parse the time stamp from ",,"

Thanks!

Re: could not use strptime to parse timestamp - csv file

smudge797 — Thu, 30 Apr 2015 13:47:23 GMT

correction im using TIME_FORMAT = %d/%m/%Y

Re: could not use strptime to parse timestamp - csv file

smudge797 — Fri, 15 May 2015 09:13:19 GMT

Anyone help on this?

Re: could not use strptime to parse timestamp - csv file

vganjare — Fri, 15 May 2015 09:16:45 GMT

Can you please verify the CSV? Concecutive ,, in the csv headers might be causing the issue.

Thanks!!

Re: could not use strptime to parse timestamp - csv file

smudge797 — Fri, 15 May 2015 13:51:11 GMT

Yes if i remove those ,, it works no problem. But i dont want to do that each time. How can i tell splunk to ignore it?

Re: could not use strptime to parse timestamp - csv file

vganjare — Mon, 18 May 2015 07:55:30 GMT

Can you please check if http://answers.splunk.com/answers/54904/replacing-with-sedcmd.html helps?

Thanks!!

Re: could not use strptime to parse timestamp - csv file

vganjare — Wed, 20 May 2015 05:22:03 GMT

Is it working for you?

Thanks!!

Re: could not use strptime to parse timestamp - csv file

rphillips_splk — Mon, 28 Sep 2020 20:02:14 GMT

Try setting the TIME_PREFIX since there is a , in front of the date. This should work:

$SPLUNK_HOME/etc/system/local/props.conf on indexers:

[your_sourcetype]
TIME_FORMAT=%d/%m/%Y
TIME_PREFIX=,
MAX_TIMESTAMP_LOOKAHEAD=10
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true