Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is it possible to use a part of the source name as _time during CSV import?

$
0
0
Hi, I'm uploading multiple CSV files. Unfortunately, they don't have a usable field for the timestamp. Is it possible to grab a part of the filename (source field) to define _time? The structure of the filenames look like this: "random count of signs **2015-11-01**-2015-11-30.csv" I'm thinking of a combination of `strptime` and `substr`, something similar to this command: strptime((substr(source, 1, len(source)-15)), "%Y-%m-%d") Best Heinz

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>