Splunk Search

Issue with date and time for indexed csv data

darshini2790
Explorer

I am facing date time issue while indexing csv data .
I do have a date field in my CSV file but i want to consider system time for an indexed data. I have added below parameters into props.conf of windows UF and on single instance linux splunk server $splunk home$/etc/system/local props.conf but still it is taking date/ time from the csv file.
Please suggest.

DATETIME_CONFIG = NONE
MAX_TIMESTAMP_LOOKAHEAD = 0

Tags (1)
0 Karma
1 Solution

skalliger
SplunkTrust
SplunkTrust

Hi,

  1. MAX_TIMESTAMP_LOOKAHEAD should not be set to 0.
  2. DATETIME_CONFIG should not be set to "none" in your case.
  3. Did you set KV_MODE = none on your Search Head? The question is, if you want indexed extractions or not.

Skalli

View solution in original post

skalliger
SplunkTrust
SplunkTrust

Hi,

  1. MAX_TIMESTAMP_LOOKAHEAD should not be set to 0.
  2. DATETIME_CONFIG should not be set to "none" in your case.
  3. Did you set KV_MODE = none on your Search Head? The question is, if you want indexed extractions or not.

Skalli

niketn
Legend

@darshini2790 if you are planning to use current time, should you not be using?

   DATETIME_CONFIG = CURRENT 
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

darshini2790
Explorer

Yes I have tried that as well and no luck.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...