Getting Data In

csv timestamp

a212830
Champion

Hi,

I'm working on adding some csv data into splunk, and while some data looks ok, some other data is being bunched together. I'm wondering if the issue is that my data is 24 hour clock, but the 0-11 hours are appearing as single digits. I have the following in my props.conf:

TIME_FORMAT= %d-%b-%y %H:%M:%S

The data looks like:
26-May-12 23:58:15,APF-US211i-RH-Cpu-0,CPU_Utilization,6.00000000,2
26-May-12 23:58:17,APF-US211i-RH-Cpu-0,CPU_Utilization,6.00000000,32
26-May-12 23:58:49,APF-US211i-RH-Cpu-0,CPU_Utilization,6.00000000,30
26-May-12 23:59:19,APF-US211i-RH-Cpu-0,CPU_Utilization,7.00000000,27
26-May-12 0:09:01,APF-US212i-RH-Cpu-0,CPU_Utilization,2.00000000,338
26-May-12 0:14:39,APF-US212i-RH-Cpu-0,CPU_Utilization,2.00000000,340
26-May-12 0:20:19,APF-US212i-RH-Cpu-0,CPU_Utilization,2.00000000,338
26-May-12 0:25:57,APF-US212i-RH-Cpu-0,CPU_Utilization,2.00000000,338

Any suggestions?

Tags (2)
0 Karma

lguinn2
Legend

I would add this to props.conf

SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD = 19

This will tell Splunk that your file contains only single-line events. This will definitely stop the "bunching."
It also tells Splunk that your timestamp appears in the first 19 characters of the event. This may not be necessary, but it does make Splunk slightly more efficient.

I don't know if you really need the TIME_FORMAT either - Splunk is usually very good at interpreting timestamps.

Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...