Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How can I manually set the timestamp at index ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have events with a field:
2015|...
2016|...
2017|...
I want to set a timestamp at index time for each event with same day and month:
1/2/2015
1/2/2016
1/2/2017
Thanks in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@jvardev,
as far as i am aware, you can not assign a manual timestamp in indextime when having the year only.
with that being said, dealing with structured data as yours (and any data in splunk), you can convert the time in search time and apply it however you would like.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@jvardev,
as far as i am aware, you can not assign a manual timestamp in indextime when having the year only.
with that being said, dealing with structured data as yours (and any data in splunk), you can convert the time in search time and apply it however you would like.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To solve this, I append the timestamp (day and month) with a script before index it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How is this data generated? Would it be possible for you to update the file generator to include the day and month in the file data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have csv files, but I want know if exists way to fill _time field correctly at index time. I could replace every year with day and month but that's not the question why that is before the index time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is it a pipe delimited data? does it have a header?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes, is delimited by pipes and I have the name fields
name1|name2|...
value1|value2|....
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
