topic Re: Extracting event date from file path in Getting Data In

Extracting event date from file path

swdonline — Mon, 05 Sep 2011 00:27:04 GMT

hello all,

I have a set of log files being created in a directory structure as:
/data/hostname/year/month/day/logfile

I understand that I can use the host_segment command to extract the field. I cannot, however, seem to find a way for splunk to automatically extract the date from this path. Any recommendations would be appreciated.

Re: Extracting event date from file path

Ayn — Mon, 05 Sep 2011 06:58:23 GMT

While I haven't tried this is a setup of my own, according to the documentation Splunk should be doing this automatically if it cannot find a timestamp for events in a file.

See the precedence rules for how Splunk assigns timestamps to events here: http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

Re: Extracting event date from file path

swdonline — Mon, 05 Sep 2011 17:13:40 GMT

Thanks Ayn. I did indeed check the docs prior to posting and what I think is the problem is "4. If no events in a source have a date, look in the source (or file) name (Must have time in the event)." Specifically, my events have no timestamps. It's just a summary of items for a 24 hour period. So it seems to be defaulting to #5 or #6. Is there a workaround to force date extraction without timestamps? Or a way to force a timestamp of 00:00 without scripting input?

Re: Extracting event date from file path

n0b1ta — Tue, 10 Apr 2012 05:55:24 GMT

I'm having the same proble,. I'm quite new to splunk.
Can anyone please describe more details ?
How can I setup dynamic directories based on timestamp?

Thanks

Re: Extracting event date from file path

gelica — Tue, 09 Jul 2013 05:48:10 GMT

Hi,
Did you ever find a way to do this? 🙂