Getting Data In

Failed to parse timestamp in psv file

the_sigma
Explorer

I have the following pipe separated value file that I am having problems onboarding.  The first row is the column headers. Second row is sample data.  I'm getting an error when attempting to use the CREA_TS column as the timestamps

CREA_TS|ACTION|PRSN_ADDR_AUDT_ID|PRSN_ADDR_ID|PRSN_ID|SRC_ID
07102024070808|INSERT|165713232|147994550|101394986|OLASFL

 

This is what I have for props but I cannot get it to identify the timestamp.   Any help will be greatly appreciated.

[ psv ]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
description=Pipe-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
LINE_BREAKER=([\r\n]+)
TIMESTAMP_FIELDS=CREA_TS
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=14
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

I think the time format is more likely to be

TIME_FORMAT=%m%d%Y%H%M%S

View solution in original post

manjunathmeti
Champion

Hi @the_sigma,

Try these configs:

[ psv ]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=PSV
SHOULD_LINEMERGE=false
category=Structured
description=Pipe-separated value format.
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=14
TIME_FORMAT=%d%m%Y%H%M%S

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I think the time format is more likely to be

TIME_FORMAT=%m%d%Y%H%M%S

the_sigma
Explorer

It ended up being the time format was wrong.  I had the month and day swapped.  Thanks all for chiming in.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @the_sigma,

the props.conf seems to be ok, what's the issue you have?

the only thing is that I don't see the TIME_FORMAT field.

try saving a copy of your data in a text file and adding it using the Add data function: in this way you can test your extraction and eventual updates.

Ciao.

Giuseppe

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...