Getting Data In

Getting date and time from CSV

Splunk Employee
Splunk Employee

Hi,

This is on Splunk 5 and I have a csv file sample header as foo,foo2,foo3,foo4,foo5,foo6
The date is on foo3 as 17/5/13 and the time is on foo5 as 815

I have the below in my props

[stype]

INDEXED_EXTRACTIONS = CSV

TIMESTAMP_FIELDS = foo3,foo5

TIME_FORMAT=%d-%m-%y %H%M

SHOULD_LINEMERGE = False

pulldown_type = 1

HEADER_FIELD_LINE_NUMBER = 1

REPORT-stype = stype_extract

and transform

[stype_extract]

DELIMS=","

FIELDS = "foo1", "foo2", "foo3", "foo4", "foo5",

Please kindly advise where i am missing. Thanks

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Well, your date format specifies "-", but the data you say uses "/".

Also, indexed extractions only work on Splunk 6.0 and higher, not 5.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!