How to set Timestamp that is in the first line of the file

[ejmin]

Here is the format of my .csv file

1. Store|460|2018/09/04
2. ColumnX|ColumnY|ColumnZ|ColumnXY|ColumnYZ
3. dataX| dataY|dataZ|dataXY|dataYZ

Assume the pipe is tab

Normally when I ingest the file in tab delimited format or tsv file the line that I can see is the line starting from 2 and so on because splunk automatically detects the line 2 for it to become a column header. I also tried for the Timestamp Fields and it doesnt work because the timestamp doesnt have column field and also the same for the Timestamp Format

[lakshman239]

You need to use INDEXED_EXTRACTIONS = TSV and also specify the time fields and header fields. Pls check this and also share your inputs and props.conf on your forwarder instance.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Extractfieldsfromfileswithstructureddata#For...

[ejmin]

Hmmm... I think its not applicable to my test environment because its a single instance and doesn't use Forwarder. I tried your INDEXED_EXTRACTIONS=TSV to my Advanced tab in indexing the data and it seems not work... My goal is to extract timestamp to my first line of my file. but anyway Thank you for answering