topic timestamp base on filename in Getting Data In

timestamp base on filename

ray_cao — Mon, 28 Sep 2020 12:27:56 GMT

Though the row data has timestamp but I want to replace this timestamp with date of the filename.

For example:

event:20120507214400,12,10,12028593134,12038621218,10,10101,1

filename:Test_20120503_000.log

I want to get "20120503" instead of "20120507214400".
How can I do?

Thank you very much.

Re: timestamp base on filename

Ayn — Wed, 19 Sep 2012 08:28:04 GMT

This docs section covers how Splunk assigns timestamps to events: http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

You might have success with setting a bogus TIME_FORMAT so Splunk is forced to resort to other ways of getting timestamps.

Re: timestamp base on filename

ray_cao — Mon, 28 Sep 2020 12:28:01 GMT

Thank you for your reply.

I delete the time of the events,then splunk doesn't fetch the filename's time but modification time.Splunk can't parse the filename?

filename: "mmss_reference_20120211_001.log "

Re: timestamp base on filename

bmacias84 — Wed, 19 Sep 2012 19:48:15 GMT

The only way I could think of accomplishing this would be using the transform.conf and props.conf. Below are code snippets that might get you most of the way.

http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction

transform.conf

[cust-time]
REGEX = \w+_([^_]{8})
SOURCE_KEY =  source
DESK_KEY = timestamp

props.conf

[custom-log]
TRANSFORMS-1=cust-time

Re: timestamp base on filename

marcoscala — Mon, 28 Sep 2020 16:12:18 GMT

DESK_KEY = timestamp does not exist.
DESK_KEY = _time is fine, but _time must be in EPOC time.... That's my problem too.