Getting Data In

Is there a way I can force Splunk to ignore all date/time values found in a csv and use ingest time for the _time value?

raysonjoberts
Explorer

I have a simple .csv I ingest daily via a monitored file, my .csv has some fields in it that show dates/time, but they do NOT represent the time I want the event indexed at. 
I want the _time to show the time the .csv field was ingested and for Splunk to ignore the other fields in the .csv which have dates/time present. 

I have created a new source type by cloning .csv and set the timestamp to use "current time", however, Splunk will still prefer to use random dates/times found in field values and only use "current time" when no fields contain any other time information.

I can "fix" this by manually adding a time field in the .csv before ingesting, but I am trying to automate this process as much as possible.

Is there a way I can force Splunk to ignore all date/time values found in a .csv and use ingest time for the _time value?

Thank you in advance!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Putting DATETIME_CONFIG = CURRENT in the appropriate props.conf stanza should do it.  If that fails, try DATETIME_CONFIG = NONE.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Putting DATETIME_CONFIG = CURRENT in the appropriate props.conf stanza should do it.  If that fails, try DATETIME_CONFIG = NONE.

---
If this reply helps you, Karma would be appreciated.
0 Karma

raysonjoberts
Explorer

That works perfectly, thank you!

Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...