Getting Data In

CSV timestamp extraction issue

sains
New Member

I am indexing a simple CSV file local on the spunk server. I am trying to extract the correct time stamp from the CSV file (every line is an event) but splunk keep using the file's modified date as the timestamp. Below is the sample line from the csv file and the regex I am trying. what am I doing wrong here?
Sample line
"03/04/2014","58.71","*",""," xxxxxxxxxxx9682"

regex I have tried so far
\d{2}/\d{2}/\d{4}
^"\d{2}/\d{2}/\d{4}"
"\d{2}/\d{2}/\d{4}"

Also tried the following time format

%m/%d/%Y

Tags (2)
0 Karma
1 Solution

nekb1958
Path Finder

Hi

short test with "your" data in data preview mode

Specify timestamp format (strptime) = %m/%d/%Y
Timestamp is always prefaced by a pattern = ^"

results to the following props.conf

TIME_FORMAT=%m/%d/%Y
TIME_PREFIX=^"

works for me.

View solution in original post

0 Karma

nekb1958
Path Finder

Hi

short test with "your" data in data preview mode

Specify timestamp format (strptime) = %m/%d/%Y
Timestamp is always prefaced by a pattern = ^"

results to the following props.conf

TIME_FORMAT=%m/%d/%Y
TIME_PREFIX=^"

works for me.

0 Karma

sains
New Member

This worked!. I thought I tried this before but might have missed something. thanks for your help.

0 Karma

sains
New Member

It works if my csv file has time stamp in addition to date e.g. "03/04/2014 00:00:00".
Any way to do it with just the date stamp?

0 Karma

lguinn2
Legend

I would use Splunk's data preview to help with this. But add this stanza to props.conf and you should be okay. BTW, this assumes that you set the sourcetype to "myCSV" in inputs.conf

props.conf

[myCSV]
SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD = 15
TIME_FORMAT = %m/%d/%Y
INDEXED_EXTRACTIONS = CSV
FIELD_NAMES = tstamp, field1, field2, field3, ccnum

The last 2 lines may not apply if you are not using Splunk 6.

0 Karma

sains
New Member

Thanks for your reply.
I tried this using data preview and advanced mode (pros.conf) but it shows the same result. I am using splunk 6.0.2. Anything else I can try?

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...