Getting Data In

Unable to extract timestamp from CSV file

rajasha
Explorer

I'm trying to extract timestamp exactly from the CSV for each event, but doesnt happen. It show only indexed time in the search head results. Anything I'm doing here wrong ?

Props.conf

[websense:cg:kv]
TIME_PREFIX ="(.*?1)","(.*?)"
TIME_FORMAT=[%d/%m/%y %H:%M:%S]
TRANSFORMS-eliminate_header = eliminate_header
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER = ,
TIMESTAMP_FIELDS = Date,Time
HEADER_FIELD_LINE_NUMBER = 1

Transforms.conf

[eliminate_header]
REGEX = "Date"|"Time"|"Action"|"Category Name"|"Localized Country"|"Policy Name"
DEST_KEY = queue
FORMAT = nullQueue

 

Sample event:

"16/02/2021","07:19:41","Allowed","Collaboration - Office","None","##DEFAULT_Policy","abc@ff.com","eer-ltp-55dd8","live.com","None","None","pptsgs.officeapps.live.com:443/","None","None","34.98.220.117","United States","52.109.124.129","United States","10.212.168.62","None","None","None","None","None","Unknown","Unknown","594","17711","18305.0","Endpoint (Proxy Connect)","Static Classification","None","443","None","Connect"

0 Karma

manjunathmeti
Champion

hi @rajasha,
Drop TIME_PREFIX and TIME_FORMAT.

[websense:cg:kv]
TIMESTAMP_FIELDS = Date,Time
TRANSFORMS-eliminate_header = eliminate_header
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER = ,
HEADER_FIELD_LINE_NUMBER = 1

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma

rajasha
Explorer

Hi @manjunathmeti  

I implemented the same in HF, but no luck. Still I'm seeing the same Indexed time stamp for all events and not the timestamp present in the csv file for each row. Please help. 

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...