Getting Data In

Defining time column in .csv uploaded

kiraitachi
Engager

Good afternoon.

This question might be already answered. But so far I searched I had no luck in understanding how to fix my issue. I worked before coding search syntax with Splunk but never before doing admin stuff inside Splunk.

I have a csv file with some columns and one of them is "Date" field which I want to use to sort the values in my other columns example:

date Total Ransom
01/07/2017 0
01/08/2017 160
01/09/2017 191
01/10/2017 257
01/11/2017 147
01/12/2017 194
01/01/2018 77
01/02/2018 187
01/03/2018 364
01/04/2018 274
01/05/2018 85

I would need to make a count with "Total Ransom" sorted by "Date" is pretty easy, but I cant define Date as _time.

¿How would I be able to do this? I read something about modifying the file datetime.xml , but I want to be sure before I modify a system file.

Thanks for your time in advance!

0 Karma
1 Solution

kiraitachi
Engager

So answering to myself. I tried above answers but where not quite what I was looking for.

Although I found how to do it following http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Configuretimestamprecognition

As simple as to follow properly the formas supported:

strptime() format expression examples
Here are some sample date formats, with the strptime() expressions that handle them:

1998-12-31 %Y-%m-%d
98-12-31 %y-%m-%d
1998 years, 312 days %Y years, %j days
Jan 24, 2003 %b %d, %Y
January 24, 2003 %B %d, %Y
1397477611.862 %s.%3N

So when specifying timefield input, go to custom and specify the field that has the "date" and its format.

Thanks!

View solution in original post

0 Karma

kiraitachi
Engager

So answering to myself. I tried above answers but where not quite what I was looking for.

Although I found how to do it following http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Configuretimestamprecognition

As simple as to follow properly the formas supported:

strptime() format expression examples
Here are some sample date formats, with the strptime() expressions that handle them:

1998-12-31 %Y-%m-%d
98-12-31 %y-%m-%d
1998 years, 312 days %Y years, %j days
Jan 24, 2003 %b %d, %Y
January 24, 2003 %B %d, %Y
1397477611.862 %s.%3N

So when specifying timefield input, go to custom and specify the field that has the "date" and its format.

Thanks!

0 Karma

woodcock
Esteemed Legend

You should click Accept on your answer and UpVote any others that helped.

0 Karma

woodcock
Esteemed Legend

Use INDEXED_EXTRACTIONS as documented here:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

pradeepkumarg
Influencer

Try this

 | inputlookup my_lookup.csv | eval New_Date = strptime(Date, "%d/%m/%Y")| sort New_Date | fields - New_Date 

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...