Splunk is picking up a csv file that looks like this:
My assumption was that I would be able to do this:
and end up with 25,5,3. But splunk is adding milliseconds to _time resulting in unique times/events:
I could use the date stamp column from the csv:
but I want to be able to use timechart and adjust span so I don't always have to use 10 minute intervals.
Should I be importing the data differently or is there a way around this?
asked 28 Mar '11, 23:21
I don't know if it's mis-parsing the data and getting milliseconds, but that's a separate issue. You can fix that by providing explicit TIME_FORMAT and TIME_PREFIX to match your data.
As for reporting, however, you should simply be able to do:
or use whatever time span you like.
Also, I'm not sure why you'd need
So whether or not the data has milliseconds, you should be able to adjust for it.
answered 29 Mar '11, 00:04