topic Re: setting the timestamp from source file name instead of the date in the events in Getting Data In https://community.splunk.com/t5/Getting-Data-In/setting-the-timestamp-from-source-file-name-instead-of-the-date/m-p/81490#M16822 <P><A href="http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/">http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/</A></P> Wed, 29 Feb 2012 15:58:17 GMT gkanapathy 2012-02-29T15:58:17Z setting the timestamp from source file name instead of the date in the events https://community.splunk.com/t5/Getting-Data-In/setting-the-timestamp-from-source-file-name-instead-of-the-date/m-p/81489#M16821 <P>I have log files with file names like:</P> <PRE><CODE>report-2012-02-25.csv report-2012-02-26.csv </CODE></PRE> <P>In those reports only some events have a date field. </P> <P>How could I force Splunk to use the date extracted from the file name instead of the dates recognized in the events for all of them?</P> Wed, 29 Feb 2012 14:43:13 GMT https://community.splunk.com/t5/Getting-Data-In/setting-the-timestamp-from-source-file-name-instead-of-the-date/m-p/81489#M16821 imrago 2012-02-29T14:43:13Z Re: setting the timestamp from source file name instead of the date in the events https://community.splunk.com/t5/Getting-Data-In/setting-the-timestamp-from-source-file-name-instead-of-the-date/m-p/81490#M16822 <P><A href="http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/">http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/</A></P> Wed, 29 Feb 2012 15:58:17 GMT https://community.splunk.com/t5/Getting-Data-In/setting-the-timestamp-from-source-file-name-instead-of-the-date/m-p/81490#M16822 gkanapathy 2012-02-29T15:58:17Z Re: setting the timestamp from source file name instead of the date in the events https://community.splunk.com/t5/Getting-Data-In/setting-the-timestamp-from-source-file-name-instead-of-the-date/m-p/81491#M16823 <P>Thank you for that, but found another problem. Time field is needed to be present in the events based on the documentation:</P> <OL> <LI>If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)</LI> </OL> Wed, 29 Feb 2012 19:01:44 GMT https://community.splunk.com/t5/Getting-Data-In/setting-the-timestamp-from-source-file-name-instead-of-the-date/m-p/81491#M16823 imrago 2012-02-29T19:01:44Z