Import files

[julienpl]

I've notice when I import a file of system logs the date is when they were imported. How can I set Splunk to recognize the date is the first field in the raw data? Is there some pre-processing I need to do to the data for this to happen?

[andrewkenth]

Splunk should find the field but you can force it using the props.config file.

In this example I am importing a csv file with the timestamp as the first field however it was a wonky (date only) format and Splunk was not recognizing it as the time. I had to tell Splunk the format (TIME_FORMAT) it was in and whcih field to use as the timestamp (TIMESTAMP_FIELDS), even though the timestamp is the first field.

Sourctype = EstgToSplunk_Employee

[EstgToSplunk_Employee]
NO_BINARY_CHECK = 1
pulldown_type = 1
FIELD_DELIMITER=,
FIELD_QUOTE="
HEADER_FIELD_LINE_NUMBER = 2
TIME_FORMAT = %Y-%m-%d
TIMESTAMP_FIELDS=DATE