Having issue importing csv, the Data format looks like this in CSV:
,Transactions,,,,,,,,
,XXXX XXXX XXXX 7282: ,,30/10/2014 to 30/04/2015,,,,,,
,,,,,,,,,
,Date,,Description,,Money in,Money Out,Balance,,
,,,,,,,,,
,30/04/2015,,"CARD PAYMENT TO SPOTIFY SPOTIFY PREMIU,9.99 GBP, RATE 1.00/GBP ON 28-04-2015",,,_9.99,"_1,579.75",,
,29/04/2015,,"CARD PAYMENT TO THE SOUTHERN CO-OP,4.95 GBP, RATE 1.00/GBP ON 27-04-2015",,,_4.95,"_1,589.74",,
,28/04/2015,,"CARD PAYMENT TO HOMEBASE LTD 107,34.99 GBP, RATE 1.00/GBP ON 25-04-2015",,,_34.99,"_1,594.69",,
Im using TIME_FORMAT = %d/%m/%y and im seeing error:
could not use the strptime to parse the time stamp from ",,"
Thanks!
Try setting the TIME_PREFIX since there is a , in front of the date. This should work:
$SPLUNK_HOME/etc/system/local/props.conf on indexers:
[your_sourcetype]
TIME_FORMAT=%d/%m/%Y
TIME_PREFIX=,
MAX_TIMESTAMP_LOOKAHEAD=10
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
correction im using TIME_FORMAT = %d/%m/%Y
Anyone help on this?
Can you please verify the CSV? Concecutive ,, in the csv headers might be causing the issue.
Thanks!!
Yes if i remove those ,, it works no problem. But i dont want to do that each time. How can i tell splunk to ignore it?
Can you please check if http://answers.splunk.com/answers/54904/replacing-with-sedcmd.html helps?
Thanks!!
Is it working for you?
Thanks!!