Getting Data In

CSV TImestamp Problem

mehal
New Member

Hello Folks,

I have a csv file which has timestamp divided among various fields.
(Initial 4 columns are shown)
year,quarter,month,day.....
2000,2,3,15
2009,4,10,23

etc..

now if i specify time format as %Y, %m, %d then it considers quarter as month and month as day.
I want to by-pass quarter and get values of year, month and day.

Can any one tell me how can I achieve this ??

If you have some doubt with question then do let me know.

Mehal

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

You'd have to specify a custom datetime.xml for parsing this.

Can you provide a complete sample?

0 Karma

mehal
New Member

Year is 4 digits long. example 1999
quarter is 1 digit long. example 3
month is max 2 digits long example 12 or 4
dayofmonth is max 2 digits long example 5 or 23
CRSdeptTime is 4 digits long example 0930 [09 hours 30 min]

0 Karma

mehal
New Member
  • also in between dayofweek and CRSDeptTime there are 10-15 columns.
0 Karma

mehal
New Member

Hi Dart,

The file has numerous number of data fields (columns)..
They are as below : (shown relevant only )
year,quarter,month,dayofmonth,dayofweek,.......,CRSDeptTime,....
where CRSDeptTIme has hours in from of hhmm.

Now i want to extract fields year, month , dayofmonth and CRSDeptTIme to determine timestamp..
Anyidea on how i can achieve this ???

In case still you have doubt with format plz do let me know.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...