Hi, I am new to splunk and hence, just to experiment with the tool I added some bank statement data into splunk in the form of csv file. The date field in the file is in the format " mm/dd/yy". Splunk did not recognize the date field as date, instead it created a "_time" field and has added the timestamp value of the data entry . The visual data distribution shows all data in the same timestamp. I need help to make splunk use the date field instead of the creation time.
You just need to configure the time when you input the data:
time x y z
11/11/11 1 2 6
12/12/12 12 3 6
12/13/13 2 4 6
12/14/14 35 4 8
%m/%d/%y
- this is called strptime formatYou just need to configure the time when you input the data:
time x y z
11/11/11 1 2 6
12/12/12 12 3 6
12/13/13 2 4 6
12/14/14 35 4 8
%m/%d/%y
- this is called strptime formatYou may benefit from reading on how timestamp assignment works in Splunk
That was a really simple fix !! Thank you so much .