https://community.splunk.com/t5/Getting-Data-In/Time-stamp-field-using-transforms-conf/m-p/238858#M46391 <P>HI All,</P> <P>Am have CSV which is semicolon as delimiter and am using Props and transpose to extract the fields. But am assigning fields name in the transpose and am not able to set _time field . Please let me know how to do that.</P> <P>Props.conf </P> <P>[Jbossorder]<BR /> REPORT-formation = split_header<BR /> BREAK_ONLY_BEFORE = SO;</P> <P>transforms.conf <BR /> [split_header]<BR /> DELIMS = ;<BR /> FIELDS =H1,H2,H3,H4,datetime</P> <P>Thanks<BR /> Sathish Rangan</P> Tue, 29 Sep 2020 11:19:42 GMT rsathish47 2020-09-29T11:19:42Z https://community.splunk.com/t5/Getting-Data-In/Time-stamp-field-using-transforms-conf/m-p/238858#M46391 <P>HI All,</P> <P>Am have CSV which is semicolon as delimiter and am using Props and transpose to extract the fields. But am assigning fields name in the transpose and am not able to set _time field . Please let me know how to do that.</P> <P>Props.conf </P> <P>[Jbossorder]<BR /> REPORT-formation = split_header<BR /> BREAK_ONLY_BEFORE = SO;</P> <P>transforms.conf <BR /> [split_header]<BR /> DELIMS = ;<BR /> FIELDS =H1,H2,H3,H4,datetime</P> <P>Thanks<BR /> Sathish Rangan</P> Tue, 29 Sep 2020 11:19:42 GMT https://community.splunk.com/t5/Getting-Data-In/Time-stamp-field-using-transforms-conf/m-p/238858#M46391 rsathish47 2020-09-29T11:19:42Z https://community.splunk.com/t5/Getting-Data-In/Time-stamp-field-using-transforms-conf/m-p/238859#M46392 <P>I fixed it using props.conf</P> <P>[Jbossorder]<BR /> FIELD_DELIMITER =;<BR /> TIME_FORMAT = %Y%m%dT%H%M%S%z<BR /> TIMESTAMP_FIELDS = datetime<BR /> FIELD_NAMES = H1,H2,H3,H4,datetime</P> Tue, 29 Sep 2020 11:19:44 GMT https://community.splunk.com/t5/Getting-Data-In/Time-stamp-field-using-transforms-conf/m-p/238859#M46392 rsathish47 2020-09-29T11:19:44Z