Uploading a CSV file, why am I getting error "Unable to parse timestamp" when I set source to CSV?

[Scan001]

i am trying to upload a csv file. When I set source to CSV, I get an error "unable to parse timestamp", defaulting to file modtime. There is a field called Timestamp with date format dd/mm/yy. I have tried multiple different file formats and setting the Timestamp options, nothing works. Can anyone advise how to resolve this?

[koshyk]

have a look at answer:
http://answers.splunk.com/answers/2672/defining-timestamp-on-data-from-csv-file.html

[richgalloway]

I can reproduce the problem using your sample data. Assuming the dates are accurate, the problem appears to lie with the 7-year-old dates. Try adjusting your MAX_DAYS_AGO setting in props.conf.

[Scan001]

I pasted that into the right file but I'm still have the same issues. Is there anything wrong here?

What I have in the file is:
[SampleR1_csv]
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = When
TIME_FORMAT = dd/mm/yy
TZ = Europe/Dublin
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true

[ csv ]
TIME_FORMAT=%Y %-m %-d %H %M %S
TIMESTAMP_FIELDS=YEAR,MONTH,DAY,HOUR,MINUTE,SECOND
SHOULD_LINEMERGE=false
INDEXED_EXTRACTIONS=csv
FIELD_DELIMITER=;
NO_BINARY_CHECK=true
KV_MODE=none
disabled=false
pulldown_type=true

[default]
max_days_ago = 2555

[richgalloway]

Did you restart Splunk after editing the file? If you have a separate indexer, the file must be modified there and the indexer restarted.

[Scan001]

I changed the variable in /etc/system/default/props.conf.

I get a error "failed to parse timestamp default to modtime"

[richgalloway]

One should never modify a file in a 'default' directory. You risk the changes getting lost the next time you upgrade Splunk. Instead, copy the relevant stanza to the same-named file in the 'local' directory and make your changes there. In your case, the etc/system/local/props.conf file should contain

[default]
max_days_ago = 2555

Splunk must be restarted for the changes to take effect.

[Scan001]

I changed the variable in /etc/system/default/props.conf.

I get a error "failed to parse timestamp default to modtime"

[Scan001]

I'm new to SPLUNK so I had to do a search for props.conf file and a number of files turn up. Which one do I change. is it /etc/users/admin/search/local/

Many thanks

[Scan001]

The following the first couple of lines of the file. (It has millions of events)

Thanks

When,EventID,ACT_Stamp,Event,Controller,Door,EventData,OriginalForename,OriginalSurname,
08/04/08,2,818806798,50,20,10,1896,Name,Name,
08/04/08,3,818806808,11,13,5,0,,,
08/04/08,4,818806827,50,15,3,4259,A8,,
08/04/08,5,818806843,11,13,5,0,,,
08/04/08,6,818806848,11,20,10,0,,,
08/04/08,7,818806873,50,20,5,6758,Name,Name,
08/04/08,8,818806876,11,13,5,0,,,
08/04/08,9,818806919,11,13,5,0,,,
08/04/08,10,818806920,50,15,4,4259,A8,,

[richgalloway]

Have you tried putting "%d/%m/%y" in the 'Timestamp format' box and also putting "Timestamp" in the "Specify all the fields which constitute the timestamp" box (all on the Timestamp tab of the Data Preview window)?

[Scan001]

Hi richgalloway.
I tried the steps you suggested and I'm still having problems. After the import, the "Time" column is populated with todays date, for some reason it will not extract the date from my "date field". I have imported other data files without this issue arising. I will add the csv file I'm importing started as a sql file on a different machine.

[richgalloway]

I suspect there's something a little off in your CSV that is confusing Splunk. Can you share a few lines of it?