topic Re: Why are events indexing with the wrong time stamp in Getting Data In

Why are events indexing with the wrong time stamp

acceo_purch — Fri, 11 Oct 2019 18:50:57 GMT

Hi,

A csv file has the format dd-mm-year hh:mm. Splunk swap the day and month for the events for the first 9 days of a month.
For example an event with a date 09-10-2019 05:05 (9 October 2019) is indexed as 10/9/19 (10 September 2019).
But an event with a date 11-10-2019 05:05 (11 October 2019) is right indexed as 10/11/19 (11 October 2019)

Here is an example of a csv file for the 10 September 2019:
"10-09-2019 05:05","PG","PER","2","2"
"10-09-2019 05:05","DG","USA","1","3"

It's indexed in the month of October the 9th 2019 instead of September 10th 2019:
TIME (M/D/Y) | EVENT (D/M/Y)
10/9/19 | 10-09-2019 05:05,PG,PER,2,2
5:30:00:000 AM
10/9/19 | 10-09-2019 05:05,DG,USA,1,3
5:30:00:000 AM

props.conf :

[csv_inv]
SEDCMD-removeDoubleQuotes= s/\"//g
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
NO_BINARY_CHECK = true
category = Structured
pulldown_type = 1
TIME_PREFIX = ^
TIME_FORMAT = %d-%m-%Y %H:%M

Can anyone help me with this?
Thanks.

Re: Why are events indexing with the wrong time stamp

richgalloway — Fri, 11 Oct 2019 20:43:07 GMT

If the CSV file really has quotation marks around each field then the time prefix is incorrect.

TIME_PREFIX = ^"

Re: Why are events indexing with the wrong time stamp

gcusello — Wed, 30 Sep 2020 02:31:55 GMT

Hi acceo_purch,
as suggested by @richgalloway, at first, use the correct TIME_PREFIX = ^\"

Then, where is this props.conf?
Usually it must be on Indexers, but when you ingest csv files it must be also on Universal Forwarders

Ciao.
Giuseppe

Re: Why are events indexing with the wrong time stamp

acceo_purch — Mon, 14 Oct 2019 17:17:43 GMT

Thank you for your help, changing the TIME_PREFIX = ^\" solved the problem.

Best regards!

Re: Why are events indexing with the wrong time stamp

acceo_purch — Mon, 14 Oct 2019 17:19:18 GMT

Thanks Giuseppe, adding the right TIME_PREFIX = ^\" solved the problem.

Best regards!