Getting Data In

How to get Splunk to recognize the date for data in a CSV file, not the creation time of the data entry?

sushmitha_mj
Communicator

Hi, I am new to splunk and hence, just to experiment with the tool I added some bank statement data into splunk in the form of csv file. The date field in the file is in the format " mm/dd/yy". Splunk did not recognize the date field as date, instead it created a "_time" field and has added the timestamp value of the data entry . The visual data distribution shows all data in the same timestamp. I need help to make splunk use the date field instead of the creation time.

Tags (4)
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

You just need to configure the time when you input the data:

Say I have a sample CSV like this:

time    x   y   z
11/11/11    1   2   6
12/12/12    12  3   6
12/13/13    2   4   6
12/14/14    35  4   8

First, add the data (the file)

alt text

Secondly, configure the timestamp field (optional in this case) and timestamp format

alt text

Which for this example, looks like %m/%d/%y - this is called strptime format

alt text

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

You just need to configure the time when you input the data:

Say I have a sample CSV like this:

time    x   y   z
11/11/11    1   2   6
12/12/12    12  3   6
12/13/13    2   4   6
12/14/14    35  4   8

First, add the data (the file)

alt text

Secondly, configure the timestamp field (optional in this case) and timestamp format

alt text

Which for this example, looks like %m/%d/%y - this is called strptime format

alt text

aljohnson_splun
Splunk Employee
Splunk Employee

You may benefit from reading on how timestamp assignment works in Splunk

sushmitha_mj
Communicator

That was a really simple fix !! Thank you so much .

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...