I need help with loading CSV files into Splunk with the event time recorded as seconds past midnight instead of HH:MM:SS time. Below is a sample of the data I need to load. How do I specify that the time column is the number of seconds past midnight when defining the Timestamp for the Source Type?
PickStartDate,BTVersion,TripNumber,Sequence,PassingTime,ArrivalTime,DepartureTime,FlagStop,ByPass,EarlyDeparture,event_line_number
2021-04-25,S1000216,1020,1,54900,54900.0,54900.0,0,0,,1
2021-04-25,S1000216,1020,2,54955,,,0,0,,2
2021-04-25,S1000216,1020,3,54999,,,0,0,,3
Yep, INGEST_EVAL is the way to go.
Firstly parse out the day as usual so you'll get the beginning of the day in the _time field. Then parse out an indexed field containing number of seconds. Then add this number to your _time. And finally, if not needed for anything else, unset the extracted field (otherwise it will get indexed).
@edgarrity - INGEST_EVAL would be one of the options I guess.
(you may have to combine multiple INGEST_EVAL and in combination with normal TRANSFORMS with REGEX to achieve the extraction and generate the right timestamp as you need.)
I hope this helps!!!
Yep, INGEST_EVAL is the way to go.
Firstly parse out the day as usual so you'll get the beginning of the day in the _time field. Then parse out an indexed field containing number of seconds. Then add this number to your _time. And finally, if not needed for anything else, unset the extracted field (otherwise it will get indexed).