Getting Data In

Is there a way I can force Splunk to ignore all date/time values found in a csv and use ingest time for the _time value?

raysonjoberts
Path Finder

I have a simple .csv I ingest daily via a monitored file, my .csv has some fields in it that show dates/time, but they do NOT represent the time I want the event indexed at. 
I want the _time to show the time the .csv field was ingested and for Splunk to ignore the other fields in the .csv which have dates/time present. 

I have created a new source type by cloning .csv and set the timestamp to use "current time", however, Splunk will still prefer to use random dates/times found in field values and only use "current time" when no fields contain any other time information.

I can "fix" this by manually adding a time field in the .csv before ingesting, but I am trying to automate this process as much as possible.

Is there a way I can force Splunk to ignore all date/time values found in a .csv and use ingest time for the _time value?

Thank you in advance!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Putting DATETIME_CONFIG = CURRENT in the appropriate props.conf stanza should do it.  If that fails, try DATETIME_CONFIG = NONE.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Putting DATETIME_CONFIG = CURRENT in the appropriate props.conf stanza should do it.  If that fails, try DATETIME_CONFIG = NONE.

---
If this reply helps you, Karma would be appreciated.
0 Karma

raysonjoberts
Path Finder

That works perfectly, thank you!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...