Getting Data In

timestamp event

gabriel94
New Member

Hi,

I have already a date field on my CSV file but it isn't recognize.

How I can help splunk to recognize this field to use as a timestamp ?

My file :
;"WIZARD_OR_SEARCH_NAME";"IDENTIFIER";"STATUS";"TEXT";"DATE"
;"NULL";"NULL";"NULL";"ok";"NULL";"2011-10-19 04:39:14"

Tags (3)
0 Karma

lguinn2
Legend

There are many settings available in Splunk for setting timestamps. For your case: First, identify the props.conf that you need to edit. If you aren't sure, you can create $SPLUNK_HOME/etc/system/local/props.conf. Try

[source::/pathtoyoursource]
MAX_TIMESTAMP_LOOKAHEAD = 0

By default, Splunk expects to see the timestamp in the first 150 characters of the event. This setting disables that, so Splunk will look all the way to the end of the event. There are other settings as well. For example, if you are trying to add older data, you might need to set MAX_DAYS_AGO.

You might also want to add

SHOULD_LINEMERGE=false

if your CSV file is one line per event. This will speed up processing of your input, and may improve timestamp recognition.

BTW, if you have control of the format of the CSV file, you could move the timestamp so it is the first column of the file. Splunk would process the input more efficiently.

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...