topic Re: index on regex field from source in Getting Data In

index on regex field from source

hiddenkirby — Sat, 22 May 2010 02:28:42 GMT

I have a dir of text files named like such scriptcalled_201005211317_stdout.txt

how do i index them on that date? I understand splunk already tries to pull the date from the source.. but if i can specify a regex i would prefer that... and i think it would be faster.

TIA,

Re: index on regex field from source

Lowell — Sat, 22 May 2010 03:39:43 GMT

Timestamp extraction from source is controlled in the $SPLUNK_HOME/etc/datetime.xml file. Search the file for "source::" and you'll see the formats supported.

I think this is your only option. And regexes are definitely involved, although probably not in the way you were thinking.

Re: index on regex field from source

hiddenkirby — Sat, 22 May 2010 04:30:51 GMT

can i create a _masheddate3 w/ my very specific regex?

Re: index on regex field from source

hiddenkirby — Mon, 28 Sep 2020 09:12:41 GMT

or would i do something similar to this in props.conf [source::/Applications/splunk/var/spool/splunk]
TIME_PREFIX = \d{14}

Re: index on regex field from source

hiddenkirby — Mon, 28 Sep 2020 09:12:44 GMT

or even something ot format it?
[source::/Applications/splunk/var/spool/splunk] TIME_PREFIX = (\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2}) FORMAT = $1/$2/$3 $4:$5:$6

Re: index on regex field from source

hiddenkirby — Sat, 22 May 2010 04:44:48 GMT

i found http://www.splunk.com/base/Documentation/4.1.2/Admin/TrainSplunkToRecognizeATimestamp

i'll try to create my own datetime.xml 😛

Re: index on regex field from source

gkanapathy — Sat, 22 May 2010 08:00:42 GMT

See here: http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

The default Splunk settings do many different formats, but you can be as specific as you like.

Re: index on regex field from source

hiddenkirby — Mon, 24 May 2010 22:50:18 GMT

Thank you! 🙂

Re: index on regex field from source

hiddenkirby — Fri, 28 May 2010 04:10:23 GMT

see http://answers.splunk.com/questions/3055/creating-a-masheddate3-in-datetime-xml/