All Apps and Add-ons

Import files

julienpl
Engager

I've notice when I import a file of system logs the date is when they were imported. How can I set Splunk to recognize the date is the first field in the raw data? Is there some pre-processing I need to do to the data for this to happen?

Tags (1)

andrewkenth
Communicator

Splunk should find the field but you can force it using the props.config file.

In this example I am importing a csv file with the timestamp as the first field however it was a wonky (date only) format and Splunk was not recognizing it as the time. I had to tell Splunk the format (TIME_FORMAT) it was in and whcih field to use as the timestamp (TIMESTAMP_FIELDS), even though the timestamp is the first field.

Sourctype = EstgToSplunk_Employee

[EstgToSplunk_Employee]
NO_BINARY_CHECK = 1
pulldown_type = 1
FIELD_DELIMITER=,
FIELD_QUOTE="
HEADER_FIELD_LINE_NUMBER = 2
TIME_FORMAT = %Y-%m-%d
TIMESTAMP_FIELDS=DATE
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...