Splunk Search

How to capture the date on line 3 of a csv file, while the header fields begin on line 5

marcos_eng1
Explorer

Dear Community, 

I Have a csv file with no timestamp with the data, I only have a timestamp on the beggining of the file (Line 3). So, How do I capture the date on line 3 of a csv file, while the header fields begin on line 5 and following data begins on line 6?

See the data as follow:

CHILLER_01
slot:/Drivers/NiagaraNetwork/TA_WEB2_CAG/points/ARQUITETURA/POC$2dCHILLERS/CHILLER_01
02-Jun-20 2:55 PM BRT

?NOME DO PONTO,VALOR
"ALARME,""0.00"""
"CAP_TOTAL,""0.00"""
"CAP_TOTAL_A,""0.00"""
"CAP_TOTAL_B,""0.00"""

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion

SEDCMD-headertrim=s/(?ms).*VALOR//

 

0 Karma

to4kawa
Ultra Champion

if header is fixed, try SEDCMD and EXTRACT with props.conf

0 Karma

marcos_eng1
Explorer

Header is fixed.

0 Karma

marcos_eng1
Explorer

Thanks....I am not really good with SEDCMD. I would really appreciate if you could provide the step by step procedure.

 

Thanks in Advance

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...