- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How can I manually set the timestamp at index ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have events with a field:
2015|...
2016|...
2017|...
I want to set a timestamp at index time for each event with same day and month:
1/2/2015
1/2/2016
1/2/2017
Thanks in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@jvardev,
as far as i am aware, you can not assign a manual timestamp in indextime when having the year only.
with that being said, dealing with structured data as yours (and any data in splunk), you can convert the time in search time and apply it however you would like.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@jvardev,
as far as i am aware, you can not assign a manual timestamp in indextime when having the year only.
with that being said, dealing with structured data as yours (and any data in splunk), you can convert the time in search time and apply it however you would like.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To solve this, I append the timestamp (day and month) with a script before index it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How is this data generated? Would it be possible for you to update the file generator to include the day and month in the file data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have csv files, but I want know if exists way to fill _time field correctly at index time. I could replace every year with day and month but that's not the question why that is before the index time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is it a pipe delimited data? does it have a header?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes, is delimited by pipes and I have the name fields
name1|name2|...
value1|value2|....
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
