Getting Data In

Is there a way I can force Splunk to ignore all date/time values found in a csv and use ingest time for the _time value?

raysonjoberts
Path Finder

I have a simple .csv I ingest daily via a monitored file, my .csv has some fields in it that show dates/time, but they do NOT represent the time I want the event indexed at. 
I want the _time to show the time the .csv field was ingested and for Splunk to ignore the other fields in the .csv which have dates/time present. 

I have created a new source type by cloning .csv and set the timestamp to use "current time", however, Splunk will still prefer to use random dates/times found in field values and only use "current time" when no fields contain any other time information.

I can "fix" this by manually adding a time field in the .csv before ingesting, but I am trying to automate this process as much as possible.

Is there a way I can force Splunk to ignore all date/time values found in a .csv and use ingest time for the _time value?

Thank you in advance!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Putting DATETIME_CONFIG = CURRENT in the appropriate props.conf stanza should do it.  If that fails, try DATETIME_CONFIG = NONE.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Putting DATETIME_CONFIG = CURRENT in the appropriate props.conf stanza should do it.  If that fails, try DATETIME_CONFIG = NONE.

---
If this reply helps you, Karma would be appreciated.
0 Karma

raysonjoberts
Path Finder

That works perfectly, thank you!

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...