All Apps and Add-ons

Import files

julienpl
Engager

I've notice when I import a file of system logs the date is when they were imported. How can I set Splunk to recognize the date is the first field in the raw data? Is there some pre-processing I need to do to the data for this to happen?

Tags (1)

andrewkenth
Communicator

Splunk should find the field but you can force it using the props.config file.

In this example I am importing a csv file with the timestamp as the first field however it was a wonky (date only) format and Splunk was not recognizing it as the time. I had to tell Splunk the format (TIME_FORMAT) it was in and whcih field to use as the timestamp (TIMESTAMP_FIELDS), even though the timestamp is the first field.

Sourctype = EstgToSplunk_Employee

[EstgToSplunk_Employee]
NO_BINARY_CHECK = 1
pulldown_type = 1
FIELD_DELIMITER=,
FIELD_QUOTE="
HEADER_FIELD_LINE_NUMBER = 2
TIME_FORMAT = %Y-%m-%d
TIMESTAMP_FIELDS=DATE
0 Karma