topic How to create a report using the Upload_time column in a CSV file, not the time the event was created? in Getting Data In

How to create a report using the Upload_time column in a CSV file, not the time the event was created?

flynnhandley — Wed, 11 Mar 2015 03:38:33 GMT

So I have a CSV file with an Upload_time column in the format 5/01/2015 15:16. (string)

I'd like to create a report that lists all items uploaded in the last month, however splunk uses the time that the event was created not the Upload_time value.

Any ideas?

Re: How to create a report using the Upload_time column in a CSV file, not the time the event was created?

skawasaki_splun — Wed, 11 Mar 2015 04:28:33 GMT

Use INDEXED_EXTRACTIONS = CSV then TIMESTAMP_FIELDS and TIME_FORMAT in props.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/propsconf

More info about INDEXED_EXTRACTIONS: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Extractfieldsfromfileheadersatindextime

Re: How to create a report using the Upload_time column in a CSV file, not the time the event was created?

flynnhandley — Wed, 11 Mar 2015 06:00:19 GMT

I'll check it out... Cheers!

Re: How to create a report using the Upload_time column in a CSV file, not the time the event was created?

flynnhandley — Mon, 28 Sep 2020 19:09:13 GMT

Just following up... I have the below entry in my props.conf when I try to upload a CSV I get an error in the time column saying "Failed to parse time stamp, defaulting to modtime"

Any ideas?

A sample of the Uploaded column:
7/01/2015 12:51

Props.conf

[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
INDEXED_EXTRACTIONS = csv
KV_MODE = none
category = Structured
TIMESTAMP_FIELDS = Uploaded
TIME_FORMAT = "%m/%d/%Y %H:%M"
description = Comma-separated value format. Set header and other settings in "Delimited Settings"