CSV: Timestamp incorrect, how do I fix?

[danfinan]

Hi guys,

I have a very simple csv file, with three columns, two of which are 'date' and 'time'. I can not (for love nor money) get the timestamp to be correct. Here is a row from my csv file:

0W4K 09-04 03/10/2019

09-04 is 09:04am and the date is obviously the date.

The timestamp is the last time the CSV was modified and I'm trying to get Splunk to indenitfy the correct time from the CSV file based on its current format.

Any help would be greatly appreciated, thank you!

[gcusello]

Hi danfinan,
try something like this in your props.conf:

[your_sourcetype]
TIME_PREFIX = ^\w+\s+
TIME_FORMAT = %H-%M %d/%m/%Y
SHOULD_LINEMERGE = false

Bye.
Giuseppe

[richgalloway]

The time format string would be "%H-%M %m/%d/%Y", but we need more information to tell you how to use it. What is the query that uses this CSV?