Getting Data In

Time stamp field using transforms.conf

rsathish47
Contributor

HI All,

Am have CSV which is semicolon as delimiter and am using Props and transpose to extract the fields. But am assigning fields name in the transpose and am not able to set _time field . Please let me know how to do that.

Props.conf

[Jbossorder]
REPORT-formation = split_header
BREAK_ONLY_BEFORE = SO;

transforms.conf
[split_header]
DELIMS = ;
FIELDS =H1,H2,H3,H4,datetime

Thanks
Sathish Rangan

0 Karma
1 Solution

rsathish47
Contributor

I fixed it using props.conf

[Jbossorder]
FIELD_DELIMITER =;
TIME_FORMAT = %Y%m%dT%H%M%S%z
TIMESTAMP_FIELDS = datetime
FIELD_NAMES = H1,H2,H3,H4,datetime

View solution in original post

0 Karma

rsathish47
Contributor

I fixed it using props.conf

[Jbossorder]
FIELD_DELIMITER =;
TIME_FORMAT = %Y%m%dT%H%M%S%z
TIMESTAMP_FIELDS = datetime
FIELD_NAMES = H1,H2,H3,H4,datetime

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...