topic CSV: Timestamp incorrect, how do I fix? in Getting Data In

CSV: Timestamp incorrect, how do I fix?

danfinan — Thu, 03 Oct 2019 14:55:17 GMT

Hi guys,

I have a very simple csv file, with three columns, two of which are 'date' and 'time'. I can not (for love nor money) get the timestamp to be correct. Here is a row from my csv file:

0W4K 09-04 03/10/2019

09-04 is 09:04am and the date is obviously the date.

The timestamp is the last time the CSV was modified and I'm trying to get Splunk to indenitfy the correct time from the CSV file based on its current format.

Any help would be greatly appreciated, thank you!

Re: CSV: Timestamp incorrect, how do I fix?

richgalloway — Thu, 03 Oct 2019 16:50:56 GMT

The time format string would be "%H-%M %m/%d/%Y", but we need more information to tell you how to use it. What is the query that uses this CSV?

Re: CSV: Timestamp incorrect, how do I fix?

gcusello — Fri, 04 Oct 2019 12:44:57 GMT

Hi danfinan,
try something like this in your props.conf:

[your_sourcetype]
TIME_PREFIX = ^\w+\s+
TIME_FORMAT = %H-%M %d/%m/%Y
SHOULD_LINEMERGE = false

Bye.
Giuseppe