<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Parse date without having a time in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88840#M18423</link>
    <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;I have tested a situation where I have a timestamp in the CSV file and everything works as expected. So the problem is really that he cannot find any time in the events so it ignores the date as well.&lt;/P&gt;

&lt;P&gt;Anyone knows how to force to a specific time?&lt;/P&gt;

&lt;P&gt;Regards,&lt;BR /&gt;
Olivier&lt;/P&gt;</description>
    <pubDate>Wed, 09 Oct 2013 13:30:25 GMT</pubDate>
    <dc:creator>OL</dc:creator>
    <dc:date>2013-10-09T13:30:25Z</dc:date>
    <item>
      <title>Parse date without having a time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88837#M18420</link>
      <description>&lt;P&gt;Hi all,&lt;/P&gt;

&lt;P&gt;I'm trying to index some csv files which contains data without a timestamp. I only have the date which is part of the name of the files. I don't mind not having the time as what it is important is the day is has been created. Unfortunately, the changes I have done result to the same output: the datetime of the event is the last modified datetime of the file. Here is what I have done:&lt;/P&gt;

&lt;P&gt;Name of the file: "13 02 01 myfile.csv"&lt;/P&gt;

&lt;P&gt;Props:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[my_csv_file]
DATETIME_CONFIG = \etc\system\local\datetime.xml
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;\etc\system\local\datetime.xml:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...
&amp;lt;define name="_masheddate3" extract="year, month, day"&amp;gt;
  &amp;lt;text&amp;gt;&amp;lt;![CDATA[(?:^|source::).*?(?&amp;lt;!\d|\d\.|-)(?:20)?([901]\d) (0\d|1[012]) ([012]\d|3[01])(?!\d|-| {2,}).*\.csv]]&amp;gt;&amp;lt;/text&amp;gt;
&amp;lt;/define&amp;gt;
...
&amp;lt;datePatterns&amp;gt;
      &amp;lt;use name="_masheddate3"/&amp;gt;
      ...
&amp;lt;/datePatterns&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Anyone knows how to solve this issue?&lt;/P&gt;

&lt;P&gt;Regards,&lt;BR /&gt;
Olivier&lt;/P&gt;</description>
      <pubDate>Tue, 08 Oct 2013 21:09:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88837#M18420</guid>
      <dc:creator>OL</dc:creator>
      <dc:date>2013-10-08T21:09:17Z</dc:date>
    </item>
    <item>
      <title>Re: Parse date without having a time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88838#M18421</link>
      <description>&lt;P&gt;I might be reading too much into the position of the "..." in &lt;CODE&gt;&amp;lt;datePatterns&amp;gt;&lt;/CODE&gt;, but if you've actually listed your &lt;CODE&gt;&amp;lt;use&amp;gt;&lt;/CODE&gt; node as the first one in your datetime.xml,  instead of as the last one, that might be it.   &lt;/P&gt;

&lt;P&gt;The last one wins I think so it might be just matching an earlier rule before it gets to yours. &lt;/P&gt;

&lt;P&gt;Move it to the end of the list.&lt;/P&gt;</description>
      <pubDate>Wed, 09 Oct 2013 01:22:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88838#M18421</guid>
      <dc:creator>sideview</dc:creator>
      <dc:date>2013-10-09T01:22:40Z</dc:date>
    </item>
    <item>
      <title>Re: Parse date without having a time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88839#M18422</link>
      <description>&lt;P&gt;Hello sideview,&lt;/P&gt;

&lt;P&gt;Thank you for your answer. Yes indeed, I have placed the &lt;USE&gt; at the first place as I thought this was the order (_usdate1 is used first!). I have moved it at the last place but I have the same issue &lt;span class="lia-unicode-emoji" title=":disappointed_face:"&gt;😞&lt;/span&gt;&lt;/USE&gt;&lt;/P&gt;

&lt;P&gt;Regards,&lt;BR /&gt;
Olivier&lt;/P&gt;</description>
      <pubDate>Wed, 09 Oct 2013 06:14:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88839#M18422</guid>
      <dc:creator>OL</dc:creator>
      <dc:date>2013-10-09T06:14:02Z</dc:date>
    </item>
    <item>
      <title>Re: Parse date without having a time</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88840#M18423</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;I have tested a situation where I have a timestamp in the CSV file and everything works as expected. So the problem is really that he cannot find any time in the events so it ignores the date as well.&lt;/P&gt;

&lt;P&gt;Anyone knows how to force to a specific time?&lt;/P&gt;

&lt;P&gt;Regards,&lt;BR /&gt;
Olivier&lt;/P&gt;</description>
      <pubDate>Wed, 09 Oct 2013 13:30:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parse-date-without-having-a-time/m-p/88840#M18423</guid>
      <dc:creator>OL</dc:creator>
      <dc:date>2013-10-09T13:30:25Z</dc:date>
    </item>
  </channel>
</rss>

