How to create a report using the Upload_time column in a CSV file, not the time the event was created?

[flynnhandley]

So I have a CSV file with an Upload_time column in the format 5/01/2015 15:16. (string)

I'd like to create a report that lists all items uploaded in the last month, however splunk uses the time that the event was created not the Upload_time value.

Any ideas?

[skawasaki_splun · Accepted solution]

Use INDEXED_EXTRACTIONS = CSV then TIMESTAMP_FIELDS and TIME_FORMAT in props.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/propsconf

More info about INDEXED_EXTRACTIONS: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Extractfieldsfromfileheadersatindextime

[flynnhandley]

I'll check it out... Cheers!

[flynnhandley]

Just following up... I have the below entry in my props.conf when I try to upload a CSV I get an error in the time column saying "Failed to parse time stamp, defaulting to modtime"

Any ideas?

---

A sample of the Uploaded column:
7/01/2015 12:51

Props.conf

[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
INDEXED_EXTRACTIONS = csv
KV_MODE = none
category = Structured
TIMESTAMP_FIELDS = Uploaded
TIME_FORMAT = "%m/%d/%Y %H:%M"
description = Comma-separated value format. Set header and other settings in "Delimited Settings"