Getting Data In

How to create a report using the Upload_time column in a CSV file, not the time the event was created?

flynnhandley
Explorer

So I have a CSV file with an Upload_time column in the format 5/01/2015 15:16. (string)

I'd like to create a report that lists all items uploaded in the last month, however splunk uses the time that the event was created not the Upload_time value.

Any ideas?

Tags (4)
0 Karma
1 Solution

skawasaki_splun
Splunk Employee
Splunk Employee
0 Karma

skawasaki_splun
Splunk Employee
Splunk Employee

Use INDEXED_EXTRACTIONS = CSV then TIMESTAMP_FIELDS and TIME_FORMAT in props.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/propsconf

More info about INDEXED_EXTRACTIONS: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Extractfieldsfromfileheadersatindextime

0 Karma

flynnhandley
Explorer

I'll check it out... Cheers!

0 Karma

flynnhandley
Explorer

Just following up... I have the below entry in my props.conf when I try to upload a CSV I get an error in the time column saying "Failed to parse time stamp, defaulting to modtime"

Any ideas?


A sample of the Uploaded column:
7/01/2015 12:51

Props.conf

[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
INDEXED_EXTRACTIONS = csv
KV_MODE = none
category = Structured
TIMESTAMP_FIELDS = Uploaded
TIME_FORMAT = "%m/%d/%Y %H:%M"
description = Comma-separated value format. Set header and other settings in "Delimited Settings"

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...