Loading custom format data into splunk

Question

I am new to splunk and need some clarification on the best approach to preprocess. I have a file in the following .csv format

field1, field2, field3,             field4, field5 
dummy    dummy   date(YYYYMMMDD)    dummy   time

The time does not have the 0 preset, so for example 13 seconds would be listed as .. '13', 1 hour 50 minutes and 22 seconds would be 15022.

Is it possible to resolve this via the default input loader via regex?. It says that 0's don't matter but the time comes out wrong, I have Y%m%d%H%M%S .

The second approach that I been looking at (if someone can point me to a quick guide people) how can I configure so for every matching *file.csv a python rule is triggered? (I don't want it to run at intervals, whenever data is being index/imported into spunk)

Thank you.

Answer 1

Does the time field contain time-of-day or elapsed time? Splunk cannot handle the latter.

Consider creating modular input(s) (Python scripts) to read the file and convert the fields as necessary. The output of the scripts will the indexed by Splunk.