- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
msarro
Builder
08-22-2011
09:22 AM
Hey everyone. All of my input data comes into splunk in .csv format. Each line is a record, and it has numerous timestamps (CDR data). I need to extract the 14th field's timestamp.
Here are the entries in my props.conf file:
TIME_PREFIX=^([^,]*,){14}
TIME_FORMAT=%Y%m%d%H%M%S.%q%Z
I used the regex for the timestamp based on this post here:
http://splunk-base.splunk.com/answers/2062/how-can-i-extract-the-date-from-the-middle-of-an-event
Any advice would be appreciated.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
msarro
Builder
08-22-2011
10:03 AM
Figured it out, I was looking one field too far forward. Thanks to everyone who looked for me!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
msarro
Builder
08-22-2011
10:03 AM
Figured it out, I was looking one field too far forward. Thanks to everyone who looked for me!
