Hi @mmodestino I'm still having difficulty getting the timestamp to parse correctly. Here is my props.conf with your code: http://imgur.com/a/9xtrJ I've looked through the CSV files and the incoming data is correct. The problem is in the way Splunk is ingesting the timestamp. Here is a picture for reference of the incorrect timestamping: http://imgur.com/a/gB2na Here is the raw data coming in from the csv: http://imgur.com/a/MPFrJ I'm not sure if this matters, but those # signs change to numbers when the field is expanded: http://imgur.com/a/IWGr6 I believe I need to change the props.conf, but I'm not sure to what exactly. Here is the timestamp parsing occurring incorrectly in the Add Data Wizard: http://imgur.com/a/hYBEQ I hope you are able to solve the problem with that information. Thanks again for all your help 🙂 ... View more

That's exactly what I was looking for! Thanks so much. Here is the final product: http://imgur.com/a/ERVTQ ... View more

I updated the post, perhaps the edit hasn't gone through yet... http://imgur.com/a/EbwTK ... View more

This is the error I get when I try to set the path directly: http://imgur.com/a/hAStX When I navigate to the Users folder and then my username, all the folders are empty. I think the permissions might not allow, and I'm not sure how to fix that. ... View more

Fixed @cmerriman ... View more

@lguinn any update? ... View more

@niketnilay The intent of zipping the file is only to upload multiple files to Splunk index in a single shot. I'm trying to use the Monitor folder option, but I am having trouble finding my folder: http://imgur.com/a/OfZZA It's currently located on my desktop, but the folder is empty in the Splunk wizard. Please advise ... View more

Aha I've found the files! Here you can see the index.conf for the webex_sentiment: http://imgur.com/a/K3Yb4 I believe I need to delete all the data that exists in the index currently, then re-upload with this new sourcetype: http://imgur.com/a/NbHIU This new timestamp will correct for the 17 to 2017 problem. However, with yours and @mmodestino's help I've realized there is a bigger problem with data integrity. Though the headers appear in the right place in the CSV format, when opened in Notepad I think there are some extra commas or something. This screenshot shows the problem when Splunk tries to ingest the data: http://imgur.com/a/jFv7Z The error for event 33 reads: Could not use strptime to parse timestamp from "Yes." Failed to parse timestamp. Defaulting to timestamp of previous event (Wed Apr 26 03:37:00 2017). There is text that should not be there appearing in the time fields... I believe the problem is with the data we are receiving from Cisco. ... View more

What/where is this third time field? I input this query, but received no results: index = webex_sentiment MyTime=* | eval surveyDate = strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | chart count(Rating) as NumberRatings by YearWeek Picture for reference: http://imgur.com/a/s8p8k I began digging into the original CSV files before they are uploaded into Splunk. Here is the picture again of the duplicated Hungary events in Splunk: http://imgur.com/a/IDYFD Looking at these events, it seems there are three duplicates at 10:57 on April 28th. However, the raw CSV for April 28th has three events at 10:57, but only one is from Hungary: http://imgur.com/a/KC63m Here is the entire raw CSV file for April 28th (the time fields are on the far right): https://app.box.com/s/tpljxe8500aegkdasgx1ghhcl3rao5sa I'm not sure what this means - perhaps the countries are being read incorrectly? For reference, here is the raw CSV file for April 19, the highest outlier in the data spike with 1,500 surveys in a single day: https://app.box.com/s/82uz69pbg8nxn3cpdfae39ytszh9t23o ... View more

Could you clarify what you mean by account for the mixed time stamps? Can this be fixed by changing the forwarders to this code you wrote? [ webex_sentiment_csv ] CHARSET=UTF-8 INDEXED_EXTRACTIONS=csv KV_MODE=none SHOULD_LINEMERGE=false category=Structured description=Webex Sentiment CSVs disabled=false pulldown_type=true TIME_FORMAT=%m/%d/%y %k:%M TZ=UTC TIMESTAMP_FIELDS=<set this to "Started or Completed" whatever field makes sense to you> HEADER_FIELD_LINE_NUMBER=1 ... View more

Thanks again. I completely agree that the survey time fields should be the time stamp, and I will try to work with the admin to accomplish that... I don't understand why it showed up as 2017 then as 17 - I don't think I'm receiving different "Started" field time formats. Here is the original screenshot and CSV data: http://imgur.com/a/SjJpd Here is the screenshot and CSV data that I posted later: http://imgur.com/a/gCsGX Perhaps my query in the first screenshot caused the different date format? Perhaps the single/double hour time digit change is a contributing factor? ... View more

I'm not sure how you figured all that out, but I'm extremely impressed. I ran this code for Hungary on those days: index = webex_sentiment Country=Hungary | eval surveyDate = strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | bin _time span=1d Results: http://imgur.com/a/IDYFD I ran this code for Germany on those days: index = webex_sentiment Country=Germany | eval surveyDate = strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | bin _time span=1d Results: http://imgur.com/a/TAdA5 It seems there are duplicated events in a series of three... What does this mean? How do I go about fixing it? Is this tied to the strptime extractions that mmodestino pointed out? Thanks so much for all your help! ... View more

@mmodestino Back with more questions 🙂 I emailed our Splunk admin and this was his response: However, this was never set up to have the timestamp correspond with the survey time. The timestamp was initially being taken on when the data was ingested into the index. We used the time fields from the survey for when a survey was taken vs the timestamp for the record. I'm not sure that I really understand what he is saying. And there still must be a problem because the data is incorrect. Any chance you can interpret this for me? Will changing the props.conf fix things? ... View more

@DalJeanis I also believe that mmodestino is on the right track - just need to work with my admin to get things sorted out with his help. I input your query with the correct capitalization: index = webex_sentiment | eval surveyDate = strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | bin _time span=1d | stats count as daycount by Country _time | eventstats avg(daycount) as avgcount stdev(daycount) as stdevcount by Country | where daycount> avgcount + 3*stdevcount This is the events list: http://imgur.com/a/SpnJP This is the country visualization: http://imgur.com/a/MH0KM The yellow spike on the far right is calls in the United States, which makes sense as our company is based here. ... View more

@mmodestino There are three different 'Call Using Computer' events that are being generated: I used WebEx\x92s \x91Call Using Computer\x92 I used WebEx\xD5s \xD4Call Using Computer\xD5 I used WebEx_s Call Using Computer Here is a picture of the first: http://imgur.com/a/r7Cfw Here is some of the raw data: Very Dissatisfied,1,-,-,-,-,,,,,,,,,,,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,Yes,Venezuela,6/22/2017 2:25:51 PM,6/22/2017 2:25:51 PM Dissatisfied,2,I had difficulty joining the audio for the meeting.,I had audio quality problems during my meeting.,-,-,-,-,Using \x91Call Using Computer\x92,-,-,Delays,-,,,,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,Yes,United States,6/22/2017 10:09:11 AM,6/22/2017 10:09:11 AM Dissatisfied,2,-,I had audio quality problems during my meeting.,-,-,,,,-,Noise or static,-,-,,,,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,Yes,Portugal,6/22/2017 8:52:54 AM,6/22/2017 8:52:54 AM Very Dissatisfied,1,I had difficulty joining the audio for the meeting.,I had audio quality problems during my meeting.,-,-,-,-,Using \x91Call Using Computer\x92,-,-,-,Call drops/disconnects,,,,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,No,Turkey,6/22/2017 8:05:39 AM,6/22/2017 8:05:39 AM Very Dissatisfied,1,-,-,I had difficulty connecting to the WebEx application.,-,,,,,,,,Application never loaded,-,-,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,Yes,France,6/22/2017 7:18:25 AM,6/22/2017 7:18:25 AM Dissatisfied,2,-,I had audio quality problems during my meeting.,-,-,,,,-,Noise or static,Delays,-,,,,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,Yes,Poland,6/22/2017 6:18:04 AM,6/22/2017 6:18:04 AM Very Dissatisfied,1,I had difficulty joining the audio for the meeting.,-,I had difficulty connecting to the WebEx application.,-,-,-,-,,,,,Application never loaded,-,-,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,No,United States,6/21/2017 3:05:23 PM,6/21/2017 3:05:23 PM Dissatisfied,2,-,-,I had difficulty connecting to the WebEx application.,-,,,,,,,,Application never loaded,-,-,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,Yes,Costa Rica,6/21/2017 12:25:35 PM,6/21/2017 12:25:35 PM Dissatisfied,2,-,-,I had difficulty connecting to the WebEx application.,-,,,,,,,,Application never loaded,Application took more than 60 seconds to load,-,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,No,India,6/21/2017 11:30:37 AM,6/21/2017 11:30:37 AM Very Dissatisfied,1,-,-,I had difficulty connecting to the WebEx application.,-,,,,,,,,-,Application took more than 60 seconds to load,-,,,,,,I used WebEx\x92s \x91Call Using Computer\x92,No,Germany,6/21/2017 9:10:18 AM,6/21/2017 9:10:18 AM Here is a picture of the second: http://imgur.com/a/acmWG Here is some of the raw data: Very Dissatisfied,1,-,I had audio quality problems during my meeting. ,-,-,,,,-,-,Delays,-,,,,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,Yes,India,4/28/2017 0:22,4/28/2017 0:22 Very Dissatisfied,1,I had difficulty joining the audio for the meeting.,I had audio quality problems during my meeting.,-,-,-,-,Using \xD4Call Using Computer\xD5,Echo,Noise or static,Delays,-,,,,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,Yes,India,5/3/2017 12:32:25 AM,5/3/2017 12:32:25 AM Very Dissatisfied,1,I had difficulty joining the audio for the meeting.,-,I had difficulty connecting to the WebEx application.,-,-,-,-,,,,,-,-,-,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,No,India,5/7/2017 11:34:02 PM,5/7/2017 11:34:02 PM Dissatisfied,2,-,I had audio quality problems during my meeting.,-,-,,,,-,Noise or static,-,-,,,,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,Yes,Costa Rica,5/5/2017 3:14:10 PM,5/5/2017 3:14:10 PM Very Dissatisfied,1,-,-,I had difficulty connecting to the WebEx application.,-,,,,,,,,Application never loaded,-,-,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,Yes,United States,5/5/2017 2:26:35 PM,5/5/2017 2:26:35 PM Dissatisfied,2,-,I had audio quality problems during my meeting.,-,-,,,,Echo,Noise or static,-,-,,,,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,Yes,United States,5/5/2017 11:27:02 AM,5/5/2017 11:27:02 AM Very Dissatisfied,1,-,I had audio quality problems during my meeting.,-,-,,,,-,Noise or static,-,Call drops/disconnects,,,,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,Yes,France,5/5/2017 5:34:04 AM,5/5/2017 5:34:04 AM Dissatisfied,2,I had difficulty joining the audio for the meeting.,-,I had difficulty connecting to the WebEx application.,-,Using \xD4Call Me\xD5,-,Using \xD4Call Using Computer\xD5,,,,,-,Application took more than 60 seconds to load,-,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,Yes,Indonesia,5/4/2017 11:33:23 PM,5/4/2017 11:33:23 PM Dissatisfied,2,-,I had audio quality problems during my meeting.,-,-,,,,-,-,-,Call drops/disconnects,,,,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,No,United States,5/4/2017 10:03:02 PM,5/4/2017 10:03:02 PM Dissatisfied,2,I had difficulty joining the audio for the meeting.,-,-,-,-,-,Using \xD4Call Using Computer\xD5,,,,,,,,,,,,,I used WebEx\xD5s \xD4Call Using Computer\xD5,No,Per\x9C,5/4/2017 1:02:36 PM,5/4/2017 1:02:36 PM Here is a picture of the third: http://imgur.com/a/vsI7H Here is the raw data: Dissatisfied,2,-,I had audio quality problems during my meeting. ,-,-,,,,Echo,Noise or static,-,-,,,,,,,,,I used WebEx_s _Call Using Computer_,Yes,Germany,4/5/2017 7:33,4/5/2017 7:33 Very Dissatisfied,1,-,-,I had difficulty connecting to the WebEx application.,-,,,,,,,,Application never loaded,-,-,,,,,,I used WebEx_s _Call Using Computer_,No,Italy,4/5/2017 7:25,4/5/2017 7:25 Dissatisfied,2,I had difficulty joining the audio for the meeting.,I had audio quality problems during my meeting. ,I had difficulty connecting to the WebEx application.,-,-,-,Using _Call Using Computer_,Echo,Noise or static,-,-,-,Application took more than 60 seconds to load,-,,,,,,I used WebEx_s _Call Using Computer_,Yes,China,4/5/2017 3:59,4/5/2017 3:59 Dissatisfied,2,-,I had audio quality problems during my meeting. ,-,-,,,,Echo,Noise or static,Delays,-,,,,,,,,,I used WebEx_s _Call Using Computer_,Yes,Japan,4/5/2017 3:45,4/5/2017 3:45 ... View more

@DalJeanis was just thanking you for your help - still trying to figure things out, but I'm much closer. Here is a screenshot of the available data fields: http://imgur.com/a/GQoc9 Looks like there is not a field which uniquely identifies each conference call, outside of the time stamp. ... View more

@mmodestino Thanks again for your help. I've made some good progress. I believe the problem is not with all single hour digits, but rather just with the zero. This screenshot shows correctly ingested data at 5 AM: http://imgur.com/a/3ABDc I was able to find the raw csv files, and here are screenshots of the headers: http://imgur.com/a/GQoc9 Please let me know the config changes I need to make 🙂 ... View more

@woodcock thanks for the response. I would like to pursue the proper index-time fix. Where do I find the props.conf? ... View more

@lguinn thanks so much! I found the problem was the "surveyDate=* Rating=*" at the start of the query. I deleted that phrase then re-ran your initial code: index=webex_sentiment | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | search YearWeek > "2016-12" | eval Rating = "Rating" . Rating | chart count by YearWeek Rating | addtotals fieldname=NumberRatings Rating* | eval NegativeSentiment = Rating1 + Rating2 | fields YearWeek NumberRatings NegativeSentiment | streamstats window=5 avg(NegativeSentiment) as MovingAverage_NegativeSentiment I received this graph: http://imgur.com/a/sC0Xz However, this displays the number of surveys with negative sentiment, rather than the percentage of surveys with negative sentiment. How do I make this change? ... View more

@lguinn I believe the problem may be elsewhere. I input your code here: http://imgur.com/a/In8ij However, there are still no events shown. In the picture from my last comment, the "search" term was shown because I was inspecting the job. Thanks again; please let me know how to fix this if you can 🙂 ... View more