topic Re: CSV Timestamp issue in Getting Data In

CSV Timestamp issue

drangzt — Mon, 28 Sep 2020 14:35:53 GMT

I am struggling to get splunk to parse the timestamps properly in a CSV file (Firefox Web History log exported to CSV). I tried the default CSV type, and all I get is the CSV file's modtime listed as the timestamps. Here are the first few lines of the CSV (redacted):

4/3/07 0:36, some url,html,????

4/3/07 0:35,some url, html,?????

4/3/07 0:34,some url,html, ????

Here is what I have added to my props.conf file:

TIME_FORMAT = %M/%D/%Y %H:%M

SHOULD_LINEMERGE = false

MAX_TIMESTAMP_LOOKAHEAD = 19

Same error. Any advice appreciated as I am new to splunk and still figuring it out.

Re: CSV Timestamp issue

kristian_kolb — Mon, 19 Aug 2013 07:11:54 GMT

You should probably try a different set of strptime/strftime variables. Currently you define your TIME_FORMAT as

minute/full date/year hour:minute

I'd try to change this into

TIME_FORMAT = %D %H:%M

%D = m/d/y

for more info, see; http://www.strftime.net

Re: CSV Timestamp issue

drangzt — Mon, 19 Aug 2013 11:53:03 GMT

Tried your suggestion and same problem. Note: I did make sure that the source file was re-indexed.

Re: CSV Timestamp issue

Ayn — Mon, 19 Aug 2013 12:00:56 GMT

There's also the issue with that %H assumes a two-digit value, so the hour "0" would not be understood (it expects "00"). %k is the equivalent without leading zero. Same goes for the day of the month (%e is without leading zero), etc.

Re: CSV Timestamp issue

kristian_kolb — Mon, 19 Aug 2013 13:20:35 GMT

Good point. Though I seem to remember that Splunk can handle optional leading zeroes. But to be more exact, try;

TIME_FORMAT = %m/%e/%y %k:%M

There is (afaik) no 1-12 format for months, %m requires 01-12. Also, if your hours are 1-12 use %l (lower-case L) instead of %k (which is 0-23).

http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Commontimeformatvariables