Importing data from a CSV file, how do I edit props.conf to assign a specific column to be parsed as _time?

[nikkkc]

Hi Guys,

I do data import from a CSV and I would like set the eventtime ( _time) to a specific column because the automatic timestamp assignment did not work for me.

Is my config possible? What is wrong? ActualStartTime is a Column in the header of the CSVFile.

props.conf:

[source::D:\Data\*.csv]
TIME_PREFIX = ActualStartTime
TIME_FORMAT=%y/%m/%d-%H:%M:%S.%3N

thanks I am 404

[Jeremiah · Accepted solution]

You can use INDEXED_EXTRACTIONS and the TIMESTAMP_FIELDS option to do this. You'll need to put these settings in the props.conf on your universal forwarder. There is a default csv sourcetype you can use to do this, or you can create your own sourcetype.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Extractfieldsfromfileswithstructureddata

[my_csv]
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS = csv
KV_MODE = none
TIMESTAMP_FIELDS = ActualStartTime
TIME_FORMAT=%y/%m/%d-%H:%M:%S.%3N

[nikkkc]

it works, thanks a lot!!!