topic Re: Extracting date from file name via custom datetime.xml not working... in Getting Data In

Extracting date from file name via custom datetime.xml not working...

sf-mike — Mon, 28 Sep 2020 15:51:48 GMT

All,

Here is the file name and my datetime.xml config. When I apply this and try to import the data, Splunk gets stuck in preview and never shows the data.

Thanks in advance for the assist!

File Name:

ADESS_FANALL_01082014_01172014_195441.csv

Datetime.xml Config

<datetime>

<define name="_masheddate3" extract="month, day, year">
        <text><![CDATA[(?:^|source::|source:).*?ADESS_FANALL_([01]\d)([0123]\d)(20[01]\d)]]></text>
</define>

<datePatterns>
        <use name="_masheddate3"/>
</datePatterns>

</datetime>

Re: Extracting date from file name via custom datetime.xml not working...

kphillipson — Fri, 13 Feb 2015 01:44:02 GMT

I myself have the same problem with a file name like the one above. Your xml output looks ok.

Re: Extracting date from file name via custom datetime.xml not working...

ramdaspr — Fri, 13 Feb 2015 06:32:52 GMT

ADESS_FANALL_(\d{2})(\d{2})20(\d{2})

might help.

Re: Extracting date from file name via custom datetime.xml not working...

kphillipson — Mon, 16 Feb 2015 14:58:53 GMT

What date is Splunk indexing it? The last modified date? That is what my file is being indexed as. I have no field inside my csv to represent time or date. Does yours?

Re: Extracting date from file name via custom datetime.xml not working...

1500372 — Tue, 29 Sep 2020 09:38:26 GMT

Did you remove all of configuration from datetime.xml? Why don't you copy datetime.xml from /etc to your directory?
I got the same situation and I resolved that like below.

copy datetime.xml to specific directory.
cp -p /home/splunk/etc/datetime.xml /home/splunk/etc/system/local/my_datetime.xml
configure props.conf
[mysourcetype]
DATETIME_CONFIG = /etc/system/local/my_datetime.xml
...
Put your datetime configuration to my_datetime.xml (I didn't remove anything from my_datetime.xml)
restart Splunk and monitor file
At that moment,I saw my test file name of ADESS_FANALL_01082014_01172014_195441.csv was indexed with expected timestamp. (14/01/08 xx:xx:xx.xxx)

Re: Extracting date from file name via custom datetime.xml not working...

snehalk — Mon, 18 Sep 2017 06:32:59 GMT

Hello @1500372,

I have followed same steps which you have mentioned in comment but am not getting any date extraction. Could you please help me

copy datetime.xml to specific directory.
cp -p /home/splunk/etc/datetime.xml /home/splunk/etc/system/local/my_datetime.xml

configure props.conf
[mysourcetype]
DATETIME_CONFIG = /etc/system/local/my_datetime.xml
...

Put your datetime configuration to my_datetime.xml (I didn't remove anything from my_datetime.xml)

restart Splunk and monitor file

Thanks in Adavance