Getting Data In

Importing data from a CSV file, how do I edit props.conf to assign a specific column to be parsed as _time?

nikkkc
Path Finder

Hi Guys,

I do data import from a CSV and I would like set the eventtime ( _time) to a specific column because the automatic timestamp assignment did not work for me.

Is my config possible? What is wrong? ActualStartTime is a Column in the header of the CSVFile.

props.conf:

[source::D:\Data\*.csv]
TIME_PREFIX = ActualStartTime
TIME_FORMAT=%y/%m/%d-%H:%M:%S.%3N

thanks I am 404

1 Solution

Jeremiah
Motivator

You can use INDEXED_EXTRACTIONS and the TIMESTAMP_FIELDS option to do this. You'll need to put these settings in the props.conf on your universal forwarder. There is a default csv sourcetype you can use to do this, or you can create your own sourcetype.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Extractfieldsfromfileswithstructureddata

[my_csv]
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS = csv
KV_MODE = none
TIMESTAMP_FIELDS = ActualStartTime
TIME_FORMAT=%y/%m/%d-%H:%M:%S.%3N

View solution in original post

Jeremiah
Motivator

You can use INDEXED_EXTRACTIONS and the TIMESTAMP_FIELDS option to do this. You'll need to put these settings in the props.conf on your universal forwarder. There is a default csv sourcetype you can use to do this, or you can create your own sourcetype.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Extractfieldsfromfileswithstructureddata

[my_csv]
SHOULD_LINEMERGE = False
INDEXED_EXTRACTIONS = csv
KV_MODE = none
TIMESTAMP_FIELDS = ActualStartTime
TIME_FORMAT=%y/%m/%d-%H:%M:%S.%3N

View solution in original post

nikkkc
Path Finder

it works, thanks a lot!!!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!