Getting Data In

Timestamp index do not consider hours

nolivieri
New Member

Hi all,

I've a csv with a timestamp like this:

2012-05-14 08

which is, of course, in the form:

%Y-%m-%d %H

Unfortunately, when trying to index it, it only takes the date:

14/05/12 00.00.00,000

How can I make it aware of the hour? Obviously it would have minutes and seconds equals to "00"...
Thanks a lot, bye!!

Edit: here is the screenshot: alt text

Tags (3)
0 Karma

Ayn
Legend

You need to tell Splunk how to parse the timestamp by providing the appropriate format in the TIME_FORMAT configuration directive in props.conf.

[my_sourcetype]
TIME_FORMAT = %Y-%m-%d %H

This will apply to events that get indexed after you've made the changes and restarted Splunk (so events that already exist in the index will not be affected).

More information on configuring timestamp recognition here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition

0 Karma

nolivieri
New Member

I've already done it by setting it in the web interface while importing the new datas...I'll try to attach a screenshot of what I already have...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...