Defining time column in .csv uploaded

[kiraitachi]

Good afternoon.

This question might be already answered. But so far I searched I had no luck in understanding how to fix my issue. I worked before coding search syntax with Splunk but never before doing admin stuff inside Splunk.

I have a csv file with some columns and one of them is "Date" field which I want to use to sort the values in my other columns example:

date Total Ransom
01/07/2017 0
01/08/2017 160
01/09/2017 191
01/10/2017 257
01/11/2017 147
01/12/2017 194
01/01/2018 77
01/02/2018 187
01/03/2018 364
01/04/2018 274
01/05/2018 85

I would need to make a count with "Total Ransom" sorted by "Date" is pretty easy, but I cant define Date as _time.

¿How would I be able to do this? I read something about modifying the file datetime.xml , but I want to be sure before I modify a system file.

Thanks for your time in advance!

[kiraitachi · Accepted solution]

So answering to myself. I tried above answers but where not quite what I was looking for.

Although I found how to do it following http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Configuretimestamprecognition

As simple as to follow properly the formas supported:

strptime() format expression examples
Here are some sample date formats, with the strptime() expressions that handle them:

1998-12-31 %Y-%m-%d
98-12-31 %y-%m-%d
1998 years, 312 days %Y years, %j days
Jan 24, 2003 %b %d, %Y
January 24, 2003 %B %d, %Y
1397477611.862 %s.%3N

So when specifying timefield input, go to custom and specify the field that has the "date" and its format.

Thanks!

[woodcock]

You should click Accept on your answer and UpVote any others that helped.

[woodcock]

Use INDEXED_EXTRACTIONS as documented here:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

[pradeepkumarg]

Try this

 | inputlookup my_lookup.csv | eval New_Date = strptime(Date, "%d/%m/%Y")| sort New_Date | fields - New_Date