Splunk Set Source Type format Timestamp strptime field examples

[bogdan_nicolesc]

Hi all,

I'm trying hard to add data into Splunk from a .csv file instead of .json. I managed to convert it from .json to .csv and now, when i try to alter <Timestamp format > using strptime() is showing me time from the adding time, not the time from the field time inside the .csv that is in Epoch Unix Timestamp.

I have read this resource,  https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/Data/Configuretimestamprecognition

but to no avail ...

Please advice ...

[ITWhisperer]

Please share and example of the csv and the configuration you are using to ingest it

[bogdan_nicolesc]

As you can clearly see, in the first photo is my .csv field setup with times resembling as 1632177107637870.

The second photo, is how i want to import it.