Getting Data In

How to get Splunk to recognize the date for data in a CSV file, not the creation time of the data entry?

sushmitha_mj
Communicator

Hi, I am new to splunk and hence, just to experiment with the tool I added some bank statement data into splunk in the form of csv file. The date field in the file is in the format " mm/dd/yy". Splunk did not recognize the date field as date, instead it created a "_time" field and has added the timestamp value of the data entry . The visual data distribution shows all data in the same timestamp. I need help to make splunk use the date field instead of the creation time.

Tags (4)
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

You just need to configure the time when you input the data:

Say I have a sample CSV like this:

time    x   y   z
11/11/11    1   2   6
12/12/12    12  3   6
12/13/13    2   4   6
12/14/14    35  4   8

First, add the data (the file)

alt text

Secondly, configure the timestamp field (optional in this case) and timestamp format

alt text

Which for this example, looks like %m/%d/%y - this is called strptime format

alt text

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

You just need to configure the time when you input the data:

Say I have a sample CSV like this:

time    x   y   z
11/11/11    1   2   6
12/12/12    12  3   6
12/13/13    2   4   6
12/14/14    35  4   8

First, add the data (the file)

alt text

Secondly, configure the timestamp field (optional in this case) and timestamp format

alt text

Which for this example, looks like %m/%d/%y - this is called strptime format

alt text

aljohnson_splun
Splunk Employee
Splunk Employee

You may benefit from reading on how timestamp assignment works in Splunk

sushmitha_mj
Communicator

That was a really simple fix !! Thank you so much .

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...