How to add a timestamp to a CSV file that will display the creation time instead of default modtime when parsing?

sergiu_popescu — Mon, 10 Oct 2016 15:24:42 GMT

I have the following problem:

I receive some text files (comma separated) which I need to index and search. Problem is that the files do not contain a field with a timestamp, and I would like to add as timestamp the file CREATION date and time instead of Splunk default file modtime (which apparently is the "last modified" attribute). I really don't have other ways, it's the first thing I thought about, this scenario (when I receive the files and index them afterwards) is the only feasible scenario. Any help would be highly appreciated, usually I find this type of info by myself, but I keep failing this time...

So, to summarize, I can't change the file names (the script which generates them is unaccessible), don't have access to the files original location (security reasons) - ergo I need to work on this particular scenario with file creation time instead of file last modified.

Re: How to add a timestamp to a CSV file that will display the creation time instead of default modtime when parsing?

salmiahsan — Sun, 23 Jul 2017 08:36:33 GMT

Suggestion : Add dummy time and date column and save to any other file format . and revert back to .csv with dummy date and time remaining. ,You need to add a dummy column for date and time and save it .

topic How to add a timestamp to a CSV file that will display the creation time instead of default modtime when parsing? in Getting Data In

How to add a timestamp to a CSV file that will display the creation time instead of default modtime when parsing?

Re: How to add a timestamp to a CSV file that will display the creation time instead of default modtime when parsing?