timestamp event

[gabriel94]

Hi,

I have already a date field on my CSV file but it isn't recognize.

How I can help splunk to recognize this field to use as a timestamp ?

My file :
;"WIZARD_OR_SEARCH_NAME";"IDENTIFIER";"STATUS";"TEXT";"DATE"
;"NULL";"NULL";"NULL";"ok";"NULL";"2011-10-19 04:39:14"

[lguinn2]

There are many settings available in Splunk for setting timestamps. For your case: First, identify the props.conf that you need to edit. If you aren't sure, you can create $SPLUNK_HOME/etc/system/local/props.conf. Try

[source::/pathtoyoursource]
MAX_TIMESTAMP_LOOKAHEAD = 0

By default, Splunk expects to see the timestamp in the first 150 characters of the event. This setting disables that, so Splunk will look all the way to the end of the event. There are other settings as well. For example, if you are trying to add older data, you might need to set MAX_DAYS_AGO.

You might also want to add

SHOULD_LINEMERGE=false

if your CSV file is one line per event. This will speed up processing of your input, and may improve timestamp recognition.

BTW, if you have control of the format of the CSV file, you could move the timestamp so it is the first column of the file. Splunk would process the input more efficiently.