Hi,
This is on Splunk 5 and I have a csv file sample header as foo,foo2,foo3,foo4,foo5,foo6
The date is on foo3 as 17/5/13 and the time is on foo5 as 815
I have the below in my props
[stype]
INDEXED_EXTRACTIONS = CSV
TIMESTAMP_FIELDS = foo3,foo5
TIME_FORMAT=%d-%m-%y %H%M
SHOULD_LINEMERGE = False
pulldown_type = 1
HEADER_FIELD_LINE_NUMBER = 1
REPORT-stype = stype_extract
and transform
[stype_extract]
DELIMS=","
FIELDS = "foo1", "foo2", "foo3", "foo4", "foo5",
Please kindly advise where i am missing. Thanks
Well, your date format specifies "-", but the data you say uses "/".
Also, indexed extractions only work on Splunk 6.0 and higher, not 5.