Getting Data In

Issue with csv timestamp extraction

msarro
Builder

Hey everyone. All of my input data comes into splunk in .csv format. Each line is a record, and it has numerous timestamps (CDR data). I need to extract the 14th field's timestamp.

Here are the entries in my props.conf file:

TIME_PREFIX=^([^,]*,){14}
TIME_FORMAT=%Y%m%d%H%M%S.%q%Z

I used the regex for the timestamp based on this post here:
http://splunk-base.splunk.com/answers/2062/how-can-i-extract-the-date-from-the-middle-of-an-event

Any advice would be appreciated.

Tags (1)
0 Karma
1 Solution

msarro
Builder

Figured it out, I was looking one field too far forward. Thanks to everyone who looked for me!

View solution in original post

0 Karma

msarro
Builder

Figured it out, I was looking one field too far forward. Thanks to everyone who looked for me!

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...