Getting Data In

CSV TImestamp Problem

mehal
New Member

Hello Folks,

I have a csv file which has timestamp divided among various fields.
(Initial 4 columns are shown)
year,quarter,month,day.....
2000,2,3,15
2009,4,10,23

etc..

now if i specify time format as %Y, %m, %d then it considers quarter as month and month as day.
I want to by-pass quarter and get values of year, month and day.

Can any one tell me how can I achieve this ??

If you have some doubt with question then do let me know.

Mehal

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

You'd have to specify a custom datetime.xml for parsing this.

Can you provide a complete sample?

0 Karma

mehal
New Member

Year is 4 digits long. example 1999
quarter is 1 digit long. example 3
month is max 2 digits long example 12 or 4
dayofmonth is max 2 digits long example 5 or 23
CRSdeptTime is 4 digits long example 0930 [09 hours 30 min]

0 Karma

mehal
New Member
  • also in between dayofweek and CRSDeptTime there are 10-15 columns.
0 Karma

mehal
New Member

Hi Dart,

The file has numerous number of data fields (columns)..
They are as below : (shown relevant only )
year,quarter,month,dayofmonth,dayofweek,.......,CRSDeptTime,....
where CRSDeptTIme has hours in from of hhmm.

Now i want to extract fields year, month , dayofmonth and CRSDeptTIme to determine timestamp..
Anyidea on how i can achieve this ???

In case still you have doubt with format plz do let me know.

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...