Getting Data In

Unable to extract timestamp from CSV file

rajasha
Explorer

I'm trying to extract timestamp exactly from the CSV for each event, but doesnt happen. It show only indexed time in the search head results. Anything I'm doing here wrong ?

Props.conf

[websense:cg:kv]
TIME_PREFIX ="(.*?1)","(.*?)"
TIME_FORMAT=[%d/%m/%y %H:%M:%S]
TRANSFORMS-eliminate_header = eliminate_header
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER = ,
TIMESTAMP_FIELDS = Date,Time
HEADER_FIELD_LINE_NUMBER = 1

Transforms.conf

[eliminate_header]
REGEX = "Date"|"Time"|"Action"|"Category Name"|"Localized Country"|"Policy Name"
DEST_KEY = queue
FORMAT = nullQueue

 

Sample event:

"16/02/2021","07:19:41","Allowed","Collaboration - Office","None","##DEFAULT_Policy","abc@ff.com","eer-ltp-55dd8","live.com","None","None","pptsgs.officeapps.live.com:443/","None","None","34.98.220.117","United States","52.109.124.129","United States","10.212.168.62","None","None","None","None","None","Unknown","Unknown","594","17711","18305.0","Endpoint (Proxy Connect)","Static Classification","None","443","None","Connect"

0 Karma

manjunathmeti
Champion

hi @rajasha,
Drop TIME_PREFIX and TIME_FORMAT.

[websense:cg:kv]
TIMESTAMP_FIELDS = Date,Time
TRANSFORMS-eliminate_header = eliminate_header
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER = ,
HEADER_FIELD_LINE_NUMBER = 1

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma

rajasha
Explorer

Hi @manjunathmeti  

I implemented the same in HF, but no luck. Still I'm seeing the same Indexed time stamp for all events and not the timestamp present in the csv file for each row. Please help. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...