CSV timestamp based on 2 columns

[aasabatini]

Hi folks,

I need an help, I have to index a csv file, currently this csv file have a column for a date and another one for the hous, I need to merge these to columns to extract the timestamp aat index time with a props file.

Example

Field 1	date	hour
abc	16-06-2021	16:00  17:00
abc	16-06-2021	16:00  17:00
abc	etc....	etc...
abc	etc...	etc...

on the hour column I need only the first value

thanks in advance

Ale

[richgalloway · Accepted solution]

props.conf has settings for that.

[mysourcetype]
INDEXED_EXTRACTIONS = CSV
TIMESTAMP_FIELDS = date,hour
TIME_FORMAT = %d-%m-%Y,%H:%M

I'm not 100% certain about the separator to use in TIME_FORMAT so the comma may have to change.

[aasabatini]

Thanks @richgalloway 

works fine!

Ale