topic Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field? in Getting Data In

When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

faramarz — Thu, 29 Oct 2015 14:16:41 GMT

Hi!

I'm in the middle of importing a CSV using the Splunk GUI and am attempting to extract, from two different fields titled Month and Year, the date in which the timestamp should correlate.

The first field is titled Month and contains the month of the input, and the second is titled Year and contains the Year of the input. Basically, I want to extract that information into the _time field automatically. Is this possible? An example would be "October" in the Month field and "2015" in the Year field. It doesn't seem to recognize that it should be extracting from both fields and combining the information. Thanks for the help!

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

richgalloway — Thu, 29 Oct 2015 15:04:19 GMT

Have you tried specifying Timestamp fields without quotes?

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

faramarz — Thu, 29 Oct 2015 19:17:52 GMT

Yes, doesn't work

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

richgalloway — Thu, 29 Oct 2015 19:39:56 GMT

I wonder if "Timestamp format" and "Timestamp fields" are conflicting. Have you tried leaving the format field empty?

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

faramarz — Thu, 29 Oct 2015 19:41:33 GMT

Tried unsuccessfully. I've tried a bunch of different variations and none seem to work

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

nnmiller — Thu, 29 Oct 2015 20:05:34 GMT

Any chance you can put your header line and a couple of lines of the CSV into a pastebin or gist?

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

gcato — Mon, 02 Nov 2015 22:10:46 GMT

Not sure If you've already got this working but the problem looks to be the comma in the TIME_FORMAT. Since you've told SPlunk the date stamp fields already you do not need to use a comma. So it should look like the following instead.

TIMESTAMP_FIELDS = Month, Year
TIME_FORMAT = %B %Y

or, even TIME_FORMAT = %B%n%Y, where %n is for whitespace.

Hope this helps.

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

gcato — Thu, 05 Nov 2015 03:14:36 GMT

Hi faramarz, did you get this working? What was the solution?

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

faramarz — Thu, 05 Nov 2015 16:16:53 GMT

Got it working by just running a script to change the fields into a conglomerated field so it looked like "October 1 2015" etc. Don't think it's possible with only a month and year field.

Re: When importing a CSV in Splunk Web, how do I automatically extract values from "Month" and "Year" fields into the _time field?

gcato — Thu, 05 Nov 2015 20:08:28 GMT

Thanks for the update. I've tested my solution on 6.3 and it definitely works okay with month and years fields. But your method is just as good if you can adjust the input.