My data is formatted in a CSV file with only two kinds of data:
"Time: 7/4/2012, 213"
The columns are the date of an event and a related count type to the event. I have 1014 rows of data.
With that in mind, I set my props.conf to the following:
TIME_PREFIX= Time:
TIME_FORMAT= %m/%d/%Y
When I do this Splunk recognizes the date and sets the time stamp appropriately. However, when I access the data in a search, it uses the ingest date/time as the _time rather that the time stamp that was established when I manually set up the data input. Am I missing some key to keeping the time stamp recognition?
While I couldn't solve the problem of getting Splunk to recognize my original regex as _time, I was able to get around by using field extraction to get my date from the data and (as "Date")then using
...|eval _time= strptime(Date, "%m/%d/%Y")
Still don't understand why Splunk recognized the time stamp when I was setting up this file as new data but did not search it the same way...