Solved: CSV timestamp based on 2 columns

aasabatini · ‎06-17-2021

Hi folks,

I need an help, I have to index a csv file, currently this csv file have a column for a date and another one for the hous, I need to merge these to columns to extract the timestamp aat index time with a props file.

Example

Field 1	date	hour
abc	16-06-2021	16:00 17:00
abc	16-06-2021	16:00 17:00
abc	etc....	etc...
abc	etc...	etc...

on the hour column I need only the first value

thanks in advance

Ale

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

richgalloway · ‎06-17-2021

props.conf has settings for that.

[mysourcetype]
INDEXED_EXTRACTIONS = CSV
TIMESTAMP_FIELDS = date,hour
TIME_FORMAT = %d-%m-%Y,%H:%M

I'm not 100% certain about the separator to use in TIME_FORMAT so the comma may have to change.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎06-17-2021

props.conf has settings for that.

[mysourcetype]
INDEXED_EXTRACTIONS = CSV
TIMESTAMP_FIELDS = date,hour
TIME_FORMAT = %d-%m-%Y,%H:%M

I'm not 100% certain about the separator to use in TIME_FORMAT so the comma may have to change.

---
If this reply helps you, Karma would be appreciated.

aasabatini · ‎06-18-2021

Thanks @richgalloway

works fine!

Ale

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

CSV timestamp based on 2 columns

CSV

props.conf

source

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Join the Conversation