Getting Data In

How can I specify TIMESTAMP_FIELDS in props.conf for a CSV file without HEADERS?

asaste
Path Finder

I am loading CSV file without HEADERS in Splunk. File is getting correctly loaded in Splunk. For column names I have defined ‘FIELD_NAMES’ property in props.conf.

I have set one of the fields from ‘FIELD_NAMES’ as TIMESTAMP_FIELDS, but it is not taking it as _time
My Question is: How can I specify TIMESTAMP_FIELDS in this props.conf for CSV file without HEADERS ?

E.g
Some data in a student file

AAA,1001,98, 15:10:05.962 EST Wed Feb 4 2015
BBB,1002,87, 15:10:05.962 EST Wed Feb 4 2015
CCC,1003,90, 15:10:05.962 EST Wed Feb 4 2015

inputs.conf

[monitor:///daya01/student]
sourcetype=stu

props.conf

[stu]
SHOULD_LINEMERGE = false
FIELD_NAMES = name,id,marks, joining-time
TIMESTAMP_FIELDS = joining-time

What value should i set to TIMESTAMP_FIELDS ?

0 Karma
1 Solution

asaste
Path Finder

Hi ,
Sorry for updating late.

It was not the header issue, it was - (Hyphen) issue. Splunk convert Hyphen(-) with underscore(_) in field names. Splunk recommend to use underscore in field names instead of hyphen as hyphen is use as an arithmetic operator.

Now we have changed field name from joining-time to joining_time, so issue is resolved now.

Thanks,
ABhi

View solution in original post

asaste
Path Finder

Hi ,
Sorry for updating late.

It was not the header issue, it was - (Hyphen) issue. Splunk convert Hyphen(-) with underscore(_) in field names. Splunk recommend to use underscore in field names instead of hyphen as hyphen is use as an arithmetic operator.

Now we have changed field name from joining-time to joining_time, so issue is resolved now.

Thanks,
ABhi

richgalloway
SplunkTrust
SplunkTrust

Try specifying TIME_FORMAT in your props.conf.

TIME_FORMAT = %H:%M:%S.%3N %Z %a %b %d %Y
---
If this reply helps you, Karma would be appreciated.
0 Karma

asaste
Path Finder

Thanks for Reply,I used solution you provided, but no luck :-(. Still not able to get 'joining_time' in _time.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...