Getting Data In

Is it possible to use a part of the source name as _time during CSV import?

HeinzWaescher
Motivator

Hi,

I'm uploading multiple CSV files. Unfortunately, they don't have a usable field for the timestamp.
Is it possible to grab a part of the filename (source field) to define _time?

The structure of the filenames look like this:

"random count of signs 2015-11-01-2015-11-30.csv"

I'm thinking of a combination of strptime and substr, something similar to this command:

strptime((substr(source, 1, len(source)-15)), "%Y-%m-%d")

Best
Heinz

0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...