Getting Data In

Timestamp index do not consider hours

nolivieri
New Member

Hi all,

I've a csv with a timestamp like this:

2012-05-14 08

which is, of course, in the form:

%Y-%m-%d %H

Unfortunately, when trying to index it, it only takes the date:

14/05/12 00.00.00,000

How can I make it aware of the hour? Obviously it would have minutes and seconds equals to "00"...
Thanks a lot, bye!!

Edit: here is the screenshot: alt text

Tags (3)
0 Karma

Ayn
Legend

You need to tell Splunk how to parse the timestamp by providing the appropriate format in the TIME_FORMAT configuration directive in props.conf.

[my_sourcetype]
TIME_FORMAT = %Y-%m-%d %H

This will apply to events that get indexed after you've made the changes and restarted Splunk (so events that already exist in the index will not be affected).

More information on configuring timestamp recognition here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition

0 Karma

nolivieri
New Member

I've already done it by setting it in the web interface while importing the new datas...I'll try to attach a screenshot of what I already have...

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...