topic Importing Year/Month field in Getting Data In

Importing Year/Month field

bitfhacker — Tue, 29 Sep 2020 10:59:34 GMT

I'm trying to import a csv format using splunk.

The timestamp of log is in the format YYYY/MM.

By default, splunk fails to generate timestamp since there is not hour, minute, and second information.

An example of an event (_raw) looks like this:

AB;ZZCAD;2016/01;22.79000000
I think that this should be working:

TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
What am I doing wrong?

Re: Importing Year/Month field

inventsekar — Tue, 29 Sep 2020 10:59:37 GMT

TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7

Hi, do you have only these above three lines?!?!

Did you try adding
SHOULD_LINEMERGE
LINE_BREAKER

For TIME:PREFIX, please try -
TIME:PREFIX=\w{2}\;\w{5}\;

what sourcetype, source you are using for this file?!? Can you please copy paste the full props.conf please

Re: Importing Year/Month field

bitfhacker — Tue, 29 Sep 2020 11:02:04 GMT

You are right. I should have posted all my props.conf.

I'm using the web (have no permission to edit props.conf directly), but the results should be the same.

Here is my props.conf:

[ csv ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Structured
description=Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
LINE_BREAKER=[\r\n]

I've tried with LINE_BREAKER and SHOULD_LINEMERGE but had no success.

Re: Importing Year/Month field

bitfhacker — Wed, 21 Sep 2016 00:03:25 GMT

Is this a bug from Splunk?