Getting Data In

CSV: Timestamp incorrect, how do I fix?

danfinan
Explorer

Hi guys,

I have a very simple csv file, with three columns, two of which are 'date' and 'time'. I can not (for love nor money) get the timestamp to be correct. Here is a row from my csv file:

0W4K 09-04 03/10/2019

09-04 is 09:04am and the date is obviously the date.

The timestamp is the last time the CSV was modified and I'm trying to get Splunk to indenitfy the correct time from the CSV file based on its current format.

Any help would be greatly appreciated, thank you!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi danfinan,
try something like this in your props.conf:

[your_sourcetype]
TIME_PREFIX = ^\w+\s+
TIME_FORMAT = %H-%M %d/%m/%Y
SHOULD_LINEMERGE = false

Bye.
Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The time format string would be "%H-%M %m/%d/%Y", but we need more information to tell you how to use it. What is the query that uses this CSV?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...