Getting Data In

CSV TImestamp Problem

mehal
New Member

Hello Folks,

I have a csv file which has timestamp divided among various fields.
(Initial 4 columns are shown)
year,quarter,month,day.....
2000,2,3,15
2009,4,10,23

etc..

now if i specify time format as %Y, %m, %d then it considers quarter as month and month as day.
I want to by-pass quarter and get values of year, month and day.

Can any one tell me how can I achieve this ??

If you have some doubt with question then do let me know.

Mehal

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

You'd have to specify a custom datetime.xml for parsing this.

Can you provide a complete sample?

0 Karma

mehal
New Member

Year is 4 digits long. example 1999
quarter is 1 digit long. example 3
month is max 2 digits long example 12 or 4
dayofmonth is max 2 digits long example 5 or 23
CRSdeptTime is 4 digits long example 0930 [09 hours 30 min]

0 Karma

mehal
New Member
  • also in between dayofweek and CRSDeptTime there are 10-15 columns.
0 Karma

mehal
New Member

Hi Dart,

The file has numerous number of data fields (columns)..
They are as below : (shown relevant only )
year,quarter,month,dayofmonth,dayofweek,.......,CRSDeptTime,....
where CRSDeptTIme has hours in from of hhmm.

Now i want to extract fields year, month , dayofmonth and CRSDeptTIme to determine timestamp..
Anyidea on how i can achieve this ???

In case still you have doubt with format plz do let me know.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...