Getting Data In

Year month day only time stamp

yyao5
New Member

Hi, I'm wanting to investigate daily log in csv format using splunk.
The timestamp of log is in the format YYYY-MM-DD.
In default, splunk fails to generate timestamp since there is not hour, minute, and second information.

Please tell me the way to generate timestamp from this format.

Yash

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Did you specify something like this in your props.conf?

[your_source_or_sourcetype]
TIME_PREFIX = ([^,]*,){2}
TIME_FORMAT = %Y-%m-%d
MAX_TIMESTAMP_LOOKAHEAD = 10

If so, what were the results after a restart (for new data coming in)?

/K

0 Karma

yyao5
New Member

The line goes like followings

,"",2012-08-11,,,,21,42,1200,0,0,0.00

0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

Ok, so based on your answer that you can't change the app to log with a full timestamp, you still have an option, though it's imperfect.

In your props.conf file, you can use something like this:

[nameofyoursourcetypehere]
DATETIME_CONFIG = CURRENT 

This will cause Splunk to "assign" a timestamp of the current time (i.e. the time the file was indexed) to the events. Very likely, all of the events would have the same, or almost the same timestamp assigned since it would only take a few seconds to index the file. But, frankly, without a timestamp in the log, you don't actually know when things happened anyway.

0 Karma

yyao5
New Member

Thank you very much. No, I cannot change the logging in format. It is our original application. I will work on with changing props.conf.

0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

If having an actual timestamp is important to you (and I'm guessing it is), you're going to want to have a real timestamp placed into the csv file. What app is logging to that file? Can the logging format be changed to provide a real timestamp instead of just a date?

0 Karma

yyao5
New Member

Thank you. I cannot change it and it is O.K. I'll work on with changing props.conf.

0 Karma

kristian_kolb
Ultra Champion

Post a few sample lines of log. My guess is that you will need to specify TIME_FORMAT, TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD in your props.conf file.

Splunk will then (probably) set the time to 00:00:00 or the actual time the event was indexed.

/K

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...