Getting Data In

How can I manually set the timestamp at index time?

Path Finder

I have events with a field:

2015|...
2016|...
2017|...

I want to set a timestamp at index time for each event with same day and month:

1/2/2015 
1/2/2016
1/2/2017

Thanks in advance!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@jvardev,
as far as i am aware, you can not assign a manual timestamp in indextime when having the year only.
with that being said, dealing with structured data as yours (and any data in splunk), you can convert the time in search time and apply it however you would like.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@jvardev,
as far as i am aware, you can not assign a manual timestamp in indextime when having the year only.
with that being said, dealing with structured data as yours (and any data in splunk), you can convert the time in search time and apply it however you would like.

View solution in original post

0 Karma

Path Finder

To solve this, I append the timestamp (day and month) with a script before index it.

0 Karma

Revered Legend

How is this data generated? Would it be possible for you to update the file generator to include the day and month in the file data?

0 Karma

Path Finder

I have csv files, but I want know if exists way to fill _time field correctly at index time. I could replace every year with day and month but that's not the question why that is before the index time

0 Karma

SplunkTrust
SplunkTrust

is it a pipe delimited data? does it have a header?

0 Karma

Path Finder

yes, is delimited by pipes and I have the name fields

name1|name2|...
value1|value2|....

0 Karma