Year month day only time stamp

[yyao5]

Hi, I'm wanting to investigate daily log in csv format using splunk.
The timestamp of log is in the format YYYY-MM-DD.
In default, splunk fails to generate timestamp since there is not hour, minute, and second information.

Please tell me the way to generate timestamp from this format.

Yash

[kristian_kolb]

Did you specify something like this in your props.conf?

[your_source_or_sourcetype]
TIME_PREFIX = ([^,]*,){2}
TIME_FORMAT = %Y-%m-%d
MAX_TIMESTAMP_LOOKAHEAD = 10

If so, what were the results after a restart (for new data coming in)?

/K

[yyao5]

The line goes like followings

,"",2012-08-11,,,,21,42,1200,0,0,0.00

[mloven_splunk]

Ok, so based on your answer that you can't change the app to log with a full timestamp, you still have an option, though it's imperfect.

In your props.conf file, you can use something like this:

[nameofyoursourcetypehere]
DATETIME_CONFIG = CURRENT 

This will cause Splunk to "assign" a timestamp of the current time (i.e. the time the file was indexed) to the events. Very likely, all of the events would have the same, or almost the same timestamp assigned since it would only take a few seconds to index the file. But, frankly, without a timestamp in the log, you don't actually know when things happened anyway.

[yyao5]

Thank you very much. No, I cannot change the logging in format. It is our original application. I will work on with changing props.conf.

[mloven_splunk]

If having an actual timestamp is important to you (and I'm guessing it is), you're going to want to have a real timestamp placed into the csv file. What app is logging to that file? Can the logging format be changed to provide a real timestamp instead of just a date?

[yyao5]

Thank you. I cannot change it and it is O.K. I'll work on with changing props.conf.

[kristian_kolb]

Post a few sample lines of log. My guess is that you will need to specify TIME_FORMAT, TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD in your props.conf file.

Splunk will then (probably) set the time to 00:00:00 or the actual time the event was indexed.

/K