Getting Data In

Parse date without having a time

OL
Communicator

Hi all,

I'm trying to index some csv files which contains data without a timestamp. I only have the date which is part of the name of the files. I don't mind not having the time as what it is important is the day is has been created. Unfortunately, the changes I have done result to the same output: the datetime of the event is the last modified datetime of the file. Here is what I have done:

Name of the file: "13 02 01 myfile.csv"

Props:

[my_csv_file]
DATETIME_CONFIG = \etc\system\local\datetime.xml
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1

\etc\system\local\datetime.xml:

...
<define name="_masheddate3" extract="year, month, day">
  <text><![CDATA[(?:^|source::).*?(?<!\d|\d\.|-)(?:20)?([901]\d) (0\d|1[012]) ([012]\d|3[01])(?!\d|-| {2,}).*\.csv]]></text>
</define>
...
<datePatterns>
      <use name="_masheddate3"/>
      ...
</datePatterns>

Anyone knows how to solve this issue?

Regards,
Olivier

sideview
SplunkTrust
SplunkTrust

I might be reading too much into the position of the "..." in <datePatterns>, but if you've actually listed your <use> node as the first one in your datetime.xml, instead of as the last one, that might be it.

The last one wins I think so it might be just matching an earlier rule before it gets to yours.

Move it to the end of the list.

0 Karma

OL
Communicator

Hello,

I have tested a situation where I have a timestamp in the CSV file and everything works as expected. So the problem is really that he cannot find any time in the events so it ignores the date as well.

Anyone knows how to force to a specific time?

Regards,
Olivier

0 Karma

OL
Communicator

Hello sideview,

Thank you for your answer. Yes indeed, I have placed the at the first place as I thought this was the order (_usdate1 is used first!). I have moved it at the last place but I have the same issue 😞

Regards,
Olivier

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...