topic Re: CSV file import, problem with date format in Getting Data In

CSV file import, problem with date format

tompadora — Mon, 27 Nov 2017 18:58:52 GMT

I have been trying to onboard at custom dataset into splunk as a csv file.
But the dateformat doesnt get right.

199703260005,1997,3,26,,0,,160,Philippines,5,Southeast

First is the year 4 digits , then month 2 digits and date 2 digits and a prefix
Any suggestions?
Thanks in advance
/Thomas

Re: CSV file import, problem with date format

MuS — Mon, 27 Nov 2017 19:29:17 GMT

Hi tompadora,

if the time the first combination of 199703260005 then add the following line to your props.conf:

[cvsSourceTypeNameHere]
TIME_FORMAT = %Y%m%d

if it is the second one ,1997,3,26 then add this to your props.conf:

[cvsSourceTypeNameHere]
TIME_PREFIX = \d{12},
TIME_FORMAT = %Y,%m,%d

Hope this helps ...

cheers, MuS

Re: CSV file import, problem with date format

woodcock — Mon, 27 Nov 2017 20:40:09 GMT

You will almost certainly have to adjust some other limit settings in order for your events to be indexed, namely MAX_DAYS_AGO, otherwise you will see the events skipped with a log like "YourOldTimeHere is outside of the acceptable time window".