<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Not showing csv data in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346181#M63591</link>
    <description>&lt;P&gt;I just had a thought., What happens when you do the following query?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;sourcetype="csv" earliest=-10y latest=+10y
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Do you get anything then?&lt;/P&gt;</description>
    <pubDate>Thu, 22 Jun 2017 15:37:39 GMT</pubDate>
    <dc:creator>BlueSocket</dc:creator>
    <dc:date>2017-06-22T15:37:39Z</dc:date>
    <item>
      <title>Not showing csv data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346176#M63586</link>
      <description>&lt;P&gt;hi,&lt;BR /&gt;
I uploaded csv file having a date field. This field has current week dates as well as future week dates.&lt;BR /&gt;
CSV got uploaded successfully without any warning, but while searching on the csv it shows '0 events before 6/14/2017 8:51:00AM'.  '6/14/2017 8:51:00AM' is current time.&lt;BR /&gt;
I alreadyset MAX_DAYS_HENCE=30 in props.config&lt;/P&gt;

&lt;P&gt;While uploading&lt;BR /&gt;
 &lt;IMG src="https://community.splunk.com/storage/temp/206601-uploadcsv-3.jpg" alt="alt text" /&gt;&lt;/P&gt;

&lt;P&gt;On searching&lt;BR /&gt;
&lt;IMG src="https://community.splunk.com/storage/temp/206603-uploadcsv-2.jpg" alt="alt text" /&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 14:27:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346176#M63586</guid>
      <dc:creator>dsiob</dc:creator>
      <dc:date>2020-09-29T14:27:34Z</dc:date>
    </item>
    <item>
      <title>Re: Not showing csv data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346177#M63587</link>
      <description>&lt;P&gt;I see what is going wrong - you have given the data in the future and so the data is indexed in the future. However, the search is by default in the past. Have you tried using the search:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="New_Excel_B.csv" host="397AD-1A210036" sourcetype="csv" latest=+30d
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 14 Jun 2017 14:24:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346177#M63587</guid>
      <dc:creator>BlueSocket</dc:creator>
      <dc:date>2017-06-14T14:24:21Z</dc:date>
    </item>
    <item>
      <title>Re: Not showing csv data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346178#M63588</link>
      <description>&lt;P&gt;You can do a search for &lt;CODE&gt;All time&lt;/CODE&gt;or, as @BlueSocket said, use &lt;CODE&gt;latest=+30d&lt;/CODE&gt; or similar.&lt;/P&gt;</description>
      <pubDate>Wed, 14 Jun 2017 14:48:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346178#M63588</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-06-14T14:48:02Z</dc:date>
    </item>
    <item>
      <title>Re: Not showing csv data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346179#M63589</link>
      <description>&lt;P&gt;now the result is  "0 events (before 7/15/17 12:01:38.000 AM)"&lt;/P&gt;</description>
      <pubDate>Thu, 15 Jun 2017 05:02:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346179#M63589</guid>
      <dc:creator>dsiob</dc:creator>
      <dc:date>2017-06-15T05:02:27Z</dc:date>
    </item>
    <item>
      <title>Re: Not showing csv data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346180#M63590</link>
      <description>&lt;P&gt;One thing I noticed that it is showing count as '1' in Data Summary for 'New_Excel_B.csv' but while uploading it displayed all events the csv has. !!!&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 14:27:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346180#M63590</guid>
      <dc:creator>dsiob</dc:creator>
      <dc:date>2020-09-29T14:27:55Z</dc:date>
    </item>
    <item>
      <title>Re: Not showing csv data</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346181#M63591</link>
      <description>&lt;P&gt;I just had a thought., What happens when you do the following query?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;sourcetype="csv" earliest=-10y latest=+10y
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Do you get anything then?&lt;/P&gt;</description>
      <pubDate>Thu, 22 Jun 2017 15:37:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Not-showing-csv-data/m-p/346181#M63591</guid>
      <dc:creator>BlueSocket</dc:creator>
      <dc:date>2017-06-22T15:37:39Z</dc:date>
    </item>
  </channel>
</rss>

