How to extract the timestamp from csv file?

[Azwaliyana]

 It configure the timestamp to be the date when I upload the file. I want the timestamp to be like the highlighted one. How can I do that?

[johnhuang]

Assuming your Splunk timezone is set to the same timezone of the servicenow timestamp:

| rex "\,(?<event_time>\d{2}\/\d{2}\/\d{4}\s\d{2}\:\d{2})\,\d{2}\/"
| eval _time=strptime(event_time,"%m/%d/%Y %H:%M")

[Azwaliyana]

Why did the 1/12/22 still come out as the result? 

Thank you

[PickleRick]

Because you're in US or somewhere similar and use the illogical format m/d/y whereas your responder is used to a normal format and showed you parsing for d/m/y 🙂

Anyway, the "solution" with parsing and overwriting _time at search time works only in search time (obviously) after you've already found the events. So it will not affect your search time ranges.

If you want the events to be indexed at the right time, you need to configure proper timestamp recognition for your sourcetype (define columns extraction and proper time format and time column(s))