I've got a few different tables, all csv, that provide different information. The main events table includes a bunch of fields that reference those other tables ie title_id field will contain a number and in the title_id table the numbers match up to a specific text value. I have a number of these types of fields with matching tables. Is this something where i can upload all of the tables and join them in splunk, telling it how to reference? or is it something where i need to join the data external to splunk and upload it? My goal is that when i search for something the actual title appears instead of the title id. Sorry, i'm very new to this and super appreciate any assistance.  ... View more

I'm just starting out with splunk and have a few CSVs that i'm trying to import. the main one contains library records from the past decade. It originally contained both in and out time, but i've broken it down to be as simple as possible to start with and given it just the initial check out time. The times are all written in the same manner. There's about 134000 entries total.  game_id,attendee_id,event_id,check_out_time 328,7199,5,2010-09-05 01:32:57 228,7241,5,2010-09-05 01:33:13 379,7327,5,2010-09-05 01:33:51 96,6729,5,2010-09-05 01:34:37 when i go to import this data , the timestamp is always wrong:  I've read through numerous forum posts on splunk and other websites and had multiple people double check the csv; I cannot identify why it struggles to pull the correct timestamp for these events.    Any help will be greatly appreciated.  ... View more