topic Re: Importing data from a CSV file, how do I edit props.conf to assign a specific column to be parsed as _time? in Getting Data In

Importing data from a CSV file, how do I edit props.conf to assign a specific column to be parsed as _time?

nikkkc — Wed, 27 Jul 2016 13:34:17 GMT

Hi Guys,

I do data import from a CSV and I would like set the eventtime ( _time) to a specific column because the automatic timestamp assignment did not work for me.

Is my config possible? What is wrong? ActualStartTime is a Column in the header of the CSVFile.

props.conf:

[source::D:\Data\*.csv]
TIME_PREFIX = ActualStartTime
TIME_FORMAT=%y/%m/%d-%H:%M:%S.%3N

thanks I am 404

Re: Importing data from a CSV file, how do I edit props.conf to assign a specific column to be parsed as _time?

Jeremiah — Tue, 29 Sep 2020 10:24:33 GMT

You can use INDEXED_EXTRACTIONS and the TIMESTAMP_FIELDS option to do this. You'll need to put these settings in the props.conf on your universal forwarder. There is a default csv sourcetype you can use to do this, or you can create your own sourcetype.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Extractfieldsfromfileswithstructureddata

[my_csv]
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS = csv
KV_MODE = none
TIMESTAMP_FIELDS = ActualStartTime
TIME_FORMAT=%y/%m/%d-%H:%M:%S.%3N

Re: Importing data from a CSV file, how do I edit props.conf to assign a specific column to be parsed as _time?

nikkkc — Thu, 28 Jul 2016 06:51:05 GMT

it works, thanks a lot!!!