Getting Data In

How to configure Splunk to use a field/column from a flat CSV file as the event timestamp?

sim_tcr
Communicator

Hello,

We have a CSV file which is flat file. It has a column named 'RUNDATE' where the date is in '2016-04-20' format.
Currently, Splunk indexes all the lines in this CSV as time modified of the CSV file.
Is there a way to configure Splunk to read the RUNDATE value and set that as the event time? Below is how the sourcetype is configured on indexer's props.conf

[uow_csv]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = csv
MAX_TIMESTAMP_LOOKAHEAD=11
HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
TIMESTAMP_FIELDS = RUNDATE
TIME_FORMAT = %Y-%m-%d
MAX_TIMESTAMP_LOOKAHEAD=11
0 Karma
1 Solution

woodcock
Esteemed Legend

Subtract 1 from your MAX_TIMESTAMP_LOOKAHEAD (which is in there twice, but that should not cause it to not work), make sure that this file is on your FORWARDER, restart your forwarder and then it should work.

View solution in original post

woodcock
Esteemed Legend

Subtract 1 from your MAX_TIMESTAMP_LOOKAHEAD (which is in there twice, but that should not cause it to not work), make sure that this file is on your FORWARDER, restart your forwarder and then it should work.

sim_tcr
Communicator

putting the props.conf on the forwarder fixed the issue.
But i am confused. the sourcetype configuration is always done on the indexers right?
Now i have the file with above configuration on indexers and forwarder.
If i make a change to any of the file which one will take the change?

0 Karma

woodcock
Esteemed Legend

This is almost always the case but Splunk decided to deviate with this one, and I can see why. Using INDEXED_EXTRACTIONS makes your Universal Forwarder behave like a Heavy Forwarder (just for that input). This is in the documentation.

As far as where to put what, you can split the file into 2 different ones; one with configurations for the Forwarder and one with configurations for the Indexer; it does not have to have the same content on different types of Splunk servers.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Building off what @woodcock said, "Which configuration parameters go with which phases" section of https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F might be good reference.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...