Getting Data In

could not use strptime to parse timestamp - csv file

smudge797
Path Finder

Having issue importing csv, the Data format looks like this in CSV:

,Transactions,,,,,,,,
,XXXX XXXX XXXX 7282: ,,30/10/2014 to 30/04/2015,,,,,,
,,,,,,,,,
,Date,,Description,,Money in,Money Out,Balance,,
,,,,,,,,,
,30/04/2015,,"CARD PAYMENT TO SPOTIFY SPOTIFY PREMIU,9.99 GBP, RATE 1.00/GBP ON 28-04-2015",,,_9.99,"_1,579.75",,
,29/04/2015,,"CARD PAYMENT TO THE SOUTHERN CO-OP,4.95 GBP, RATE 1.00/GBP ON 27-04-2015",,,_4.95,"_1,589.74",,
,28/04/2015,,"CARD PAYMENT TO HOMEBASE LTD 107,34.99 GBP, RATE 1.00/GBP ON 25-04-2015",,,_34.99,"_1,594.69",,

Im using TIME_FORMAT = %d/%m/%y and im seeing error:
could not use the strptime to parse the time stamp from ",,"

Thanks!

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

Try setting the TIME_PREFIX since there is a , in front of the date. This should work:

$SPLUNK_HOME/etc/system/local/props.conf on indexers:

[your_sourcetype]
TIME_FORMAT=%d/%m/%Y
TIME_PREFIX=,
MAX_TIMESTAMP_LOOKAHEAD=10
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true

0 Karma

smudge797
Path Finder

correction im using TIME_FORMAT = %d/%m/%Y

0 Karma

smudge797
Path Finder

Anyone help on this?

0 Karma

vganjare
Builder

Can you please verify the CSV? Concecutive ,, in the csv headers might be causing the issue.

Thanks!!

0 Karma

smudge797
Path Finder

Yes if i remove those ,, it works no problem. But i dont want to do that each time. How can i tell splunk to ignore it?

0 Karma

vganjare
Builder
0 Karma

vganjare
Builder

Is it working for you?

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...