Getting Data In

How to add a timestamp to a CSV file that will display the creation time instead of default modtime when parsing?

sergiu_popescu
New Member

I have the following problem:

I receive some text files (comma separated) which I need to index and search. Problem is that the files do not contain a field with a timestamp, and I would like to add as timestamp the file CREATION date and time instead of Splunk default file modtime (which apparently is the "last modified" attribute). I really don't have other ways, it's the first thing I thought about, this scenario (when I receive the files and index them afterwards) is the only feasible scenario. Any help would be highly appreciated, usually I find this type of info by myself, but I keep failing this time...

So, to summarize, I can't change the file names (the script which generates them is unaccessible), don't have access to the files original location (security reasons) - ergo I need to work on this particular scenario with file creation time instead of file last modified.

0 Karma

salmiahsan
New Member

Suggestion : Add dummy time and date column and save to any other file format . and revert back to .csv with dummy date and time remaining. ,You need to add a dummy column for date and time and save it .

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...