topic How to Force splunk to get timestamp of file created in Getting Data In

How to Force splunk to get timestamp of file created

kannu — Tue, 12 Jul 2022 13:30:39 GMT

Hello Splunkers ,

I have one csv file which gets dumped to location being monitored by splunk UF .

That csv contains content like this

19752,"TTYHUJIKNN",sdfsdfsdfsdfwer,sdfsdfsdf,,,"04-04-2019 12:11:31 PM","06-14-2019 09:30:18 AM"

Time stamp present in above logs will get changed when every time CSV get appended by new entry of logs ,
But i dont want splunk to indexed the event based on timestamp present in logs , i want data to get indexed with the time of creation of file
like provided below it should be Jul 9 01:28

-rwxr-xr-x 1 ccc ccc 13308953 Jul 9 01:28 Device_Report07-09-2019.csv
-rwxr-xr-x 1 ccc ccc 13311527 Jul 10 01:27 Device_Report07-10-2019.csv

For achieving this i have used props.conf at UF end .
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 1

But its not working as expected , Please help

Re: Force splunk to get timestamp of file created

richgalloway — Wed, 10 Jul 2019 20:58:54 GMT

The UF won't do anything with those props.conf settings. Indexers and heavy forwarders will honor them, but they'll just end up throwing a ton of messages in splunkd.log.

Try putting DATETIME_CONFIG = NONE in the indexer's props.conf file. That's supposed to use the file's modification time. If that doesn't work, try DATETIME_CONFIG = CURRENT to use the current time for the events.

Re: Force splunk to get timestamp of file created

kannu — Thu, 11 Jul 2019 10:32:19 GMT

Ok i , will try that

Re: Force splunk to get timestamp of file created

raisomain — Wed, 18 Mar 2020 12:12:36 GMT

from what i've tried (v_7.3.1), NONE would only insert timestamp if the event/line doesn't hv time info itself, CURRENT will override timestamp on all event/line.

Re: Force splunk to get timestamp of file created

FlorianScho — Tue, 12 Jul 2022 11:40:50 GMT

Hi @kannu,

did this fix your problem?
Currently im facing the same, set DATETIME_CONFIG = Current - this inserts the file now in my configured schedule but only the headers of the CSV file..

Any suggestions?