How to use folder name/path as TimeStamp

p3hndrx — Mon, 27 Jan 2020 18:20:36 GMT

Greetings---
I am in the process of building an add-on.
I am building this add-on to utilize input data stored in folders with the structure:

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.Classic.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.Classic.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.Classic.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.All-Levels.rank.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.rank.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.rank.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.rank.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.All-Levels.brawl.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.brawl.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.brawl.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.brawl.csv

I would like to use the date in the folder path (in this case, 01272020) as the Timestamp, ideally at Index Time.

I see this documentation:
https://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

And this article:
https://answers.splunk.com/answers/94763/set-timestamp-based-on-file-source-path.html

But when I place:

EVAL-_time=strptime(file_name, "%m%d%Y")

in my props.conf, it didn't seem to work.

Re: How to use folder name/path as TimeStamp

nickhills — Mon, 27 Jan 2020 21:37:28 GMT

Ideally you need to extract the part of the path that contains a date into a field first, and then run the eval against that.
Assuming file_name is already extracted..

..your search..|rex file_name (?P<stringDate>\d{8})|eval _time=strptime(stringDate, "%m%d%Y")

Give that a go.

topic Re: How to use folder name/path as TimeStamp in Getting Data In

How to use folder name/path as TimeStamp

Re: How to use folder name/path as TimeStamp