topic Re: Timestamp creation- index time from csv file in Splunk Search

Timestamp creation- index time from csv file

sidhantbhayana — Wed, 31 Jan 2018 06:41:56 GMT

Hi All,

I have a situation where the data is in csv format and first two columns have date and time information, my requirement is to create _time using both columns during indexing.

Sample Logs:
012518,12:34:41:163,1
012618,16:04:42:100,10

I am facing problems in creating configs for the same.

_
Regards,
Sidhant

Re: Timestamp creation- index time from csv file

HiroshiSatoh — Wed, 31 Jan 2018 07:18:00 GMT

DATE,TIME,COUNT
012518,12:34:41:163,1
012618,16:04:42:100,10

Can you retrieve it with data source CSV? In my environment _time has been set without any particular settings.

Re: Timestamp creation- index time from csv file

mayurr98 — Wed, 31 Jan 2018 07:25:18 GMT

hey,

Just assign below in inputs.conf wherever your monitor stanza is!

[<your_monitor_stanza>]
index = <your_index>
sourcetype = csv

Let me know if this helps!

Re: Timestamp creation- index time from csv file

sidhantbhayana — Wed, 31 Jan 2018 07:38:35 GMT

Yes, correct! This is because you are using default sourcetype(csv). I have a custom sourcetype.

Re: Timestamp creation- index time from csv file

sidhantbhayana — Wed, 31 Jan 2018 07:40:32 GMT

It helps @mayurr98 , but I have a custom sourcetype, although I could find the solution: TIME_FORMAT=%m%d%y,%H:%M:%S:%3N

Re: Timestamp creation- index time from csv file

mayurr98 — Wed, 31 Jan 2018 07:45:38 GMT

yeah, if you have a custom sourcetype then TIME_FORMAT=%m%d%y,%H:%M:%S:%3N this would do!