I am loading CSV file without HEADERS in Splunk. File is getting correctly loaded in Splunk. For column names I have defined ‘FIELD_NAMES’ property in props.conf.
I have set one of the fields from ‘FIELD_NAMES’ as TIMESTAMP_FIELDS, but it is not taking it as _time
My Question is: How can I specify TIMESTAMP_FIELDS in this props.conf for CSV file without HEADERS ?
E.g
Some data in a student file
AAA,1001,98, 15:10:05.962 EST Wed Feb 4 2015
BBB,1002,87, 15:10:05.962 EST Wed Feb 4 2015
CCC,1003,90, 15:10:05.962 EST Wed Feb 4 2015
inputs.conf
[monitor:///daya01/student]
sourcetype=stu
props.conf
[stu]
SHOULD_LINEMERGE = false
FIELD_NAMES = name,id,marks, joining-time
TIMESTAMP_FIELDS = joining-time
What value should i set to TIMESTAMP_FIELDS ?
Hi ,
Sorry for updating late.
It was not the header issue, it was - (Hyphen) issue. Splunk convert Hyphen(-) with underscore(_) in field names. Splunk recommend to use underscore in field names instead of hyphen as hyphen is use as an arithmetic operator.
Now we have changed field name from joining-time to joining_time, so issue is resolved now.
Thanks,
ABhi
Hi ,
Sorry for updating late.
It was not the header issue, it was - (Hyphen) issue. Splunk convert Hyphen(-) with underscore(_) in field names. Splunk recommend to use underscore in field names instead of hyphen as hyphen is use as an arithmetic operator.
Now we have changed field name from joining-time to joining_time, so issue is resolved now.
Thanks,
ABhi
Try specifying TIME_FORMAT
in your props.conf.
TIME_FORMAT = %H:%M:%S.%3N %Z %a %b %d %Y
Thanks for Reply,I used solution you provided, but no luck :-(. Still not able to get 'joining_time' in _time.