- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anyway to turn off Splunk automatic detection of timestamp fields for csv indexing?
I have a csv I ingest where I just want it to default to the date of last modified for the csv... there are no actual timestamp columns in this csv, however splunk keeps automatically trying to treat some of the longer integer values as epochs, causing several rows to just get thrown out because they are detected as being decades in the past. Is there anyway I can turn this feature off per sourcetype?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Look at "Disable Timestamp Processor" section on this doc page -
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it's strange.. I've tried setting DATETIME_CONFIG = NONE, MAX_DAYS_AGO=0, MAX_TIMESTAMP_LOOKAHEAD=1, it doesn't seem like any of these have any effect, I keep getting this message:
06-07-2018 10:28:06.446 -0700 WARN DateParserVerbose - A possible timestamp match (Sun Jun 20 04:40:06 2010) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: [...]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try setting MAX_TIMESTAMP_LOOKAHEAD to a lower value in the props.conf for the sourcetype so that it doesn't reach to the point where you have the long integers? There could be other elegant solutions.
