Getting Data In

How to configure Splunk to use a field/column from a flat CSV file as the event timestamp?

sim_tcr
Communicator

Hello,

We have a CSV file which is flat file. It has a column named 'RUNDATE' where the date is in '2016-04-20' format.
Currently, Splunk indexes all the lines in this CSV as time modified of the CSV file.
Is there a way to configure Splunk to read the RUNDATE value and set that as the event time? Below is how the sourcetype is configured on indexer's props.conf

[uow_csv]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = csv
MAX_TIMESTAMP_LOOKAHEAD=11
HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
TIMESTAMP_FIELDS = RUNDATE
TIME_FORMAT = %Y-%m-%d
MAX_TIMESTAMP_LOOKAHEAD=11
0 Karma
1 Solution

woodcock
Esteemed Legend

Subtract 1 from your MAX_TIMESTAMP_LOOKAHEAD (which is in there twice, but that should not cause it to not work), make sure that this file is on your FORWARDER, restart your forwarder and then it should work.

View solution in original post

woodcock
Esteemed Legend

Subtract 1 from your MAX_TIMESTAMP_LOOKAHEAD (which is in there twice, but that should not cause it to not work), make sure that this file is on your FORWARDER, restart your forwarder and then it should work.

sim_tcr
Communicator

putting the props.conf on the forwarder fixed the issue.
But i am confused. the sourcetype configuration is always done on the indexers right?
Now i have the file with above configuration on indexers and forwarder.
If i make a change to any of the file which one will take the change?

0 Karma

woodcock
Esteemed Legend

This is almost always the case but Splunk decided to deviate with this one, and I can see why. Using INDEXED_EXTRACTIONS makes your Universal Forwarder behave like a Heavy Forwarder (just for that input). This is in the documentation.

As far as where to put what, you can split the file into 2 different ones; one with configurations for the Forwarder and one with configurations for the Indexer; it does not have to have the same content on different types of Splunk servers.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Building off what @woodcock said, "Which configuration parameters go with which phases" section of https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F might be good reference.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...