I'm trying to import a csv format using splunk.
The timestamp of log is in the format YYYY/MM.
By default, splunk fails to generate timestamp since there is not hour, minute, and second information.
An example of an event (_raw) looks like this:
AB;ZZCAD;2016/01;22.79000000
I think that this should be working:
TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
What am I doing wrong?
Is this a bug from Splunk?
TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
Hi, do you have only these above three lines?!?!
Did you try adding
SHOULD_LINEMERGE
LINE_BREAKER
For TIME:PREFIX, please try -
TIME:PREFIX=\w{2}\;\w{5}\;
what sourcetype, source you are using for this file?!? Can you please copy paste the full props.conf please
You are right. I should have posted all my props.conf.
I'm using the web (have no permission to edit props.conf directly), but the results should be the same.
Here is my props.conf:
[ csv ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Structured
description=Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
TIME_FORMAT=%Y/%m
TIME_PREFIX=(.){9}
MAX_TIMESTAMP_LOOKAHEAD=7
LINE_BREAKER=[\r\n]
I've tried with LINE_BREAKER and SHOULD_LINEMERGE but had no success.