Getting Data In

CSV TImestamp Problem

mehal
New Member

Hello Folks,

I have a csv file which has timestamp divided among various fields.
(Initial 4 columns are shown)
year,quarter,month,day.....
2000,2,3,15
2009,4,10,23

etc..

now if i specify time format as %Y, %m, %d then it considers quarter as month and month as day.
I want to by-pass quarter and get values of year, month and day.

Can any one tell me how can I achieve this ??

If you have some doubt with question then do let me know.

Mehal

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

You'd have to specify a custom datetime.xml for parsing this.

Can you provide a complete sample?

0 Karma

mehal
New Member

Year is 4 digits long. example 1999
quarter is 1 digit long. example 3
month is max 2 digits long example 12 or 4
dayofmonth is max 2 digits long example 5 or 23
CRSdeptTime is 4 digits long example 0930 [09 hours 30 min]

0 Karma

mehal
New Member
  • also in between dayofweek and CRSDeptTime there are 10-15 columns.
0 Karma

mehal
New Member

Hi Dart,

The file has numerous number of data fields (columns)..
They are as below : (shown relevant only )
year,quarter,month,dayofmonth,dayofweek,.......,CRSDeptTime,....
where CRSDeptTIme has hours in from of hhmm.

Now i want to extract fields year, month , dayofmonth and CRSDeptTIme to determine timestamp..
Anyidea on how i can achieve this ???

In case still you have doubt with format plz do let me know.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...