Splunk Search

PROPS Conf with CSV File

SplunkDash
Motivator

Hello,

I wrote a PROPS Configuration file for following csv file but getting error message. Any help will be highly appreciated. Thank you so much.

 
 

malekmo_5-1629072882970.png

 

[ csv ]

SHOULD_LINEMERGE=false

CHARSET=UTF-8

INDEXED_EXTRACTIONS=csv

TIME_FORMAT=%Y%m%d %H:%M:%S:%Q

HEADER_FIELD)LINE_NUMBER=1

TIMESTAMP_FIELDS=TIMESTAMP

category=Structured

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

@SplunkDash  try below you have to deploy them to UF.

[ csv ]
SHOULD_LINEMERGE=false
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
TIME_FORMAT=%Y%m%d %H:%M:%S:%3Q
HEADER_FIELD_LINE_NUMBER=1
TIMESTAMP_FIELDS=TIMESTAMP
category=Structured

  

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

@SplunkDash  try below you have to deploy them to UF.

[ csv ]
SHOULD_LINEMERGE=false
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
TIME_FORMAT=%Y%m%d %H:%M:%S:%3Q
HEADER_FIELD_LINE_NUMBER=1
TIMESTAMP_FIELDS=TIMESTAMP
category=Structured

  

SplunkDash
Motivator

Thank you so much. But, still getting error message...Failed to parse timestamp!!!

Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

@SplunkDash  Your field name in CSV seems TimeStamp (camel case), what you have set TIMESTAMP_FIELDs = TIMESTAMP (caps) can you correct it to match with CSV header names.

0 Karma

SplunkDash
Motivator

oops ...😀  cool working as expected, thank you so much, appreciated!!!

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...