https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180352#M36165 <P>Hi, I am new to splunk and hence, just to experiment with the tool I added some bank statement data into splunk in the form of csv file. The date field in the file is in the format " mm/dd/yy". Splunk did not recognize the date field as date, instead it created a "_time" field and has added the timestamp value of the data entry . The visual data distribution shows all data in the same timestamp. I need help to make splunk use the date field instead of the creation time.</P> Fri, 09 Jan 2015 18:26:26 GMT sushmitha_mj 2015-01-09T18:26:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180352#M36165 <P>Hi, I am new to splunk and hence, just to experiment with the tool I added some bank statement data into splunk in the form of csv file. The date field in the file is in the format " mm/dd/yy". Splunk did not recognize the date field as date, instead it created a "_time" field and has added the timestamp value of the data entry . The visual data distribution shows all data in the same timestamp. I need help to make splunk use the date field instead of the creation time.</P> Fri, 09 Jan 2015 18:26:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180352#M36165 sushmitha_mj 2015-01-09T18:26:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180353#M36166 <P>You just need to configure the time when you input the data:</P> <H4>Say I have a sample CSV like this:</H4> <PRE><CODE>time x y z 11/11/11 1 2 6 12/12/12 12 3 6 12/13/13 2 4 6 12/14/14 35 4 8 </CODE></PRE> <H4>First, add the data (the file)</H4> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/183i9573EB18BA932995/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <H4>Secondly, configure the timestamp field (optional in this case) and <EM>timestamp format</EM></H4> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/184i0607626A902895CD/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <H4>Which for this example, looks like <CODE>%m/%d/%y</CODE> - this is called <A href="http://pubs.opengroup.org/onlinepubs/009695399/functions/strptime.html">strptime</A> format</H4> <P><IMG src="http://i.imgur.com/IZocSue.png" alt="alt text" /></P> Fri, 09 Jan 2015 19:14:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180353#M36166 aljohnson_splun 2015-01-09T19:14:42Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180354#M36167 <P>You may benefit from reading on <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/HowSplunkextractstimestamps">how timestamp assignment works in Splunk</A></P> Fri, 09 Jan 2015 19:15:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180354#M36167 aljohnson_splun 2015-01-09T19:15:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180355#M36168 <P>That was a really simple fix !! Thank you so much . </P> Fri, 09 Jan 2015 21:14:36 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-recognize-the-date-for-data-in-a-CSV-file/m-p/180355#M36168 sushmitha_mj 2015-01-09T21:14:36Z