- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Timestamp creation- index time from csv file
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
I have a situation where the data is in csv format and first two columns have date and time information, my requirement is to create _time using both columns during indexing.
Sample Logs:
012518,12:34:41:163,1
012618,16:04:42:100,10
I am facing problems in creating configs for the same.
_
Regards,
Sidhant
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hey,
Just assign below in inputs.conf wherever your monitor stanza is!
[<your_monitor_stanza>]
index = <your_index>
sourcetype = csv
Let me know if this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hey,
Just assign below in inputs.conf wherever your monitor stanza is!
[<your_monitor_stanza>]
index = <your_index>
sourcetype = csv
Let me know if this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It helps @mayurr98 , but I have a custom sourcetype, although I could find the solution: TIME_FORMAT=%m%d%y,%H:%M:%S:%3N
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yeah, if you have a custom sourcetype then TIME_FORMAT=%m%d%y,%H:%M:%S:%3N this would do!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
DATE,TIME,COUNT
012518,12:34:41:163,1
012618,16:04:42:100,10
Can you retrieve it with data source CSV? In my environment _time has been set without any particular settings.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, correct! This is because you are using default sourcetype(csv). I have a custom sourcetype.
Thanks for the Memories! Splunk University, .conf24, and Community Connections
.conf24 | Day 0
Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...
