Importing Year/Month field

[bitfhacker]

I'm trying to import a csv format using splunk.

The timestamp of log is in the format YYYY/MM.

By default, splunk fails to generate timestamp since there is not hour, minute, and second information.

An example of an event (_raw) looks like this:

AB;ZZCAD;2016/01;22.79000000
I think that this should be working:

TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
What am I doing wrong?

[bitfhacker]

Is this a bug from Splunk?

[inventsekar]

TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7

Hi, do you have only these above three lines?!?!

Did you try adding
SHOULD_LINEMERGE
LINE_BREAKER

For TIME:PREFIX, please try -
TIME:PREFIX=\w{2}\;\w{5}\;

what sourcetype, source you are using for this file?!? Can you please copy paste the full props.conf please

[bitfhacker]

You are right. I should have posted all my props.conf.

I'm using the web (have no permission to edit props.conf directly), but the results should be the same.

Here is my props.conf:

[ csv ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Structured
description=Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
LINE_BREAKER=[\r\n]

I've tried with LINE_BREAKER and SHOULD_LINEMERGE but had no success.