could not use strptime to parse timestamp - csv file

[smudge797]

Having issue importing csv, the Data format looks like this in CSV:

,Transactions,,,,,,,,
,XXXX XXXX XXXX 7282: ,,30/10/2014 to 30/04/2015,,,,,,
,,,,,,,,,
,Date,,Description,,Money in,Money Out,Balance,,
,,,,,,,,,
,30/04/2015,,"CARD PAYMENT TO SPOTIFY SPOTIFY PREMIU,9.99 GBP, RATE 1.00/GBP ON 28-04-2015",,,_9.99,"_1,579.75",,
,29/04/2015,,"CARD PAYMENT TO THE SOUTHERN CO-OP,4.95 GBP, RATE 1.00/GBP ON 27-04-2015",,,_4.95,"_1,589.74",,
,28/04/2015,,"CARD PAYMENT TO HOMEBASE LTD 107,34.99 GBP, RATE 1.00/GBP ON 25-04-2015",,,_34.99,"_1,594.69",,

Im using TIME_FORMAT = %d/%m/%y and im seeing error:
could not use the strptime to parse the time stamp from ",,"

Thanks!

[rphillips_splk]

Try setting the TIME_PREFIX since there is a , in front of the date. This should work:

$SPLUNK_HOME/etc/system/local/props.conf on indexers:

[your_sourcetype]
TIME_FORMAT=%d/%m/%Y
TIME_PREFIX=,
MAX_TIMESTAMP_LOOKAHEAD=10
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true

[smudge797]

correction im using TIME_FORMAT = %d/%m/%Y

[smudge797]

Anyone help on this?

[vganjare]

Can you please verify the CSV? Concecutive ,, in the csv headers might be causing the issue.

Thanks!!

[smudge797]

Yes if i remove those ,, it works no problem. But i dont want to do that each time. How can i tell splunk to ignore it?

[vganjare]

Can you please check if http://answers.splunk.com/answers/54904/replacing-with-sedcmd.html helps?

Thanks!!

[vganjare]

Is it working for you?

Thanks!!