topic Re: How to configure Splunk to use a field/column from a flat CSV file as the event timestamp? in Getting Data In

How to configure Splunk to use a field/column from a flat CSV file as the event timestamp?

sim_tcr — Fri, 29 Apr 2016 12:00:35 GMT

Hello,

We have a CSV file which is flat file. It has a column named 'RUNDATE' where the date is in '2016-04-20' format.
Currently, Splunk indexes all the lines in this CSV as time modified of the CSV file.
Is there a way to configure Splunk to read the RUNDATE value and set that as the event time? Below is how the sourcetype is configured on indexer's props.conf

[uow_csv]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = csv
MAX_TIMESTAMP_LOOKAHEAD=11
HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
TIMESTAMP_FIELDS = RUNDATE
TIME_FORMAT = %Y-%m-%d
MAX_TIMESTAMP_LOOKAHEAD=11

Re: How to configure Splunk to use a field/column from a flat CSV file as the event timestamp?

woodcock — Fri, 29 Apr 2016 12:48:01 GMT

Subtract 1 from your MAX_TIMESTAMP_LOOKAHEAD (which is in there twice, but that should not cause it to not work), make sure that this file is on your FORWARDER, restart your forwarder and then it should work.

Re: How to configure Splunk to use a field/column from a flat CSV file as the event timestamp?

sim_tcr — Fri, 29 Apr 2016 13:04:47 GMT

putting the props.conf on the forwarder fixed the issue.
But i am confused. the sourcetype configuration is always done on the indexers right?
Now i have the file with above configuration on indexers and forwarder.
If i make a change to any of the file which one will take the change?

Re: How to configure Splunk to use a field/column from a flat CSV file as the event timestamp?

woodcock — Fri, 29 Apr 2016 13:11:03 GMT

This is almost always the case but Splunk decided to deviate with this one, and I can see why. Using INDEXED_EXTRACTIONS makes your Universal Forwarder behave like a Heavy Forwarder (just for that input). This is in the documentation.

As far as where to put what, you can split the file into 2 different ones; one with configurations for the Forwarder and one with configurations for the Indexer; it does not have to have the same content on different types of Splunk servers.

Re: How to configure Splunk to use a field/column from a flat CSV file as the event timestamp?

sloshburch — Mon, 13 Jun 2016 20:17:16 GMT

Building off what @woodcock said, "Which configuration parameters go with which phases" section of https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F might be good reference.