Getting Data In

Importing Year/Month field

bitfhacker
New Member

I'm trying to import a csv format using splunk.

The timestamp of log is in the format YYYY/MM.

By default, splunk fails to generate timestamp since there is not hour, minute, and second information.

An example of an event (_raw) looks like this:

AB;ZZCAD;2016/01;22.79000000
I think that this should be working:

TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
What am I doing wrong?

Tags (1)
0 Karma

bitfhacker
New Member

Is this a bug from Splunk?

0 Karma

inventsekar
Ultra Champion

TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7

Hi, do you have only these above three lines?!?!

Did you try adding
SHOULD_LINEMERGE
LINE_BREAKER

For TIME:PREFIX, please try -
TIME:PREFIX=\w{2}\;\w{5}\;

what sourcetype, source you are using for this file?!? Can you please copy paste the full props.conf please

0 Karma

bitfhacker
New Member

You are right. I should have posted all my props.conf.

I'm using the web (have no permission to edit props.conf directly), but the results should be the same.

Here is my props.conf:

[ csv ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Structured
description=Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
LINE_BREAKER=[\r\n]

I've tried with LINE_BREAKER and SHOULD_LINEMERGE but had no success.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...