PROPS Configuration for CSV Source Files without headers

[SplunkDash]

Hello,

I have csv source files without headers; sample events from that file and what PROPS Conf.  I wrote are given below. Values in the first column can be used as time stamps. How would I write PROPS configuration file  for that csv source file, since I am getting some error messages in timestamps and some extra  columns at the beginning of events.  Any help will be highly appreciated. Thank you so much,

Here is what I wrote:

[ csv ]

SHOULD_LINEMERGE=false

NO_BINARY_CHECK=true

INDEXED_EXTRACTIONS=csv

TIME_PREFIX=^

TIME_FORMAT=%Y-%m-%d %H:%M:%S.%6Q

FIELD_NAMES=f1,f2,f3,f4,f5,f6,f7,f8

5 Sample Events:

malekmo_0-1635976937064.png

[isoutamo · Accepted solution]

Hi

this seems to be quite correct if you have "," as a field separator.

Only thing which I modify is

TIME_FORMAT=%Y-%m-%d %H:%M:%S.%6Q %Z

As you gave also TZ information on your events.

r. Ismo