Getting Data In

timestamp event

gabriel94
New Member

Hi,

I have already a date field on my CSV file but it isn't recognize.

How I can help splunk to recognize this field to use as a timestamp ?

My file :
;"WIZARD_OR_SEARCH_NAME";"IDENTIFIER";"STATUS";"TEXT";"DATE"
;"NULL";"NULL";"NULL";"ok";"NULL";"2011-10-19 04:39:14"

Tags (3)
0 Karma

lguinn2
Legend

There are many settings available in Splunk for setting timestamps. For your case: First, identify the props.conf that you need to edit. If you aren't sure, you can create $SPLUNK_HOME/etc/system/local/props.conf. Try

[source::/pathtoyoursource]
MAX_TIMESTAMP_LOOKAHEAD = 0

By default, Splunk expects to see the timestamp in the first 150 characters of the event. This setting disables that, so Splunk will look all the way to the end of the event. There are other settings as well. For example, if you are trying to add older data, you might need to set MAX_DAYS_AGO.

You might also want to add

SHOULD_LINEMERGE=false

if your CSV file is one line per event. This will speed up processing of your input, and may improve timestamp recognition.

BTW, if you have control of the format of the CSV file, you could move the timestamp so it is the first column of the file. Splunk would process the input more efficiently.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...