Date stamp in directory name

suhprano — Tue, 15 May 2012 18:33:14 GMT

How can I configure splunk to index or accept the datestamp in the name of directories?
The events only have time stamps.

Example:

drwxr-xr-x 2 test test 57344 May 13 03:35 20120513
drwxr-xr-x 2 test test 57344 May 14 21:21 20120514
drwxr-xr-x 2 test test 57344 May 15 18:31 20120515

I'm having issues when I restart the forwarder and it doesn't recognize the date time in the meta data.

Re: Date stamp in directory name

woodcock — Mon, 06 Jul 2015 14:06:18 GMT

I am assuming that you are getting the date from the directory but the time from the events. You do it like this:

$SPLUNK_HOME/etc/apps/myApp/default/props.conf

DATETIME_CONFIG = /etc/apps/myApp/default/datetime.xml

$SPLUNK_HOME/etc/apps/myApp/default/datetime.xml

<datetime>
<define name="file4date" extract="year, month, day">
   <text><![CDATA[source::.*?/(\d{4})(\d{2})(\d{2})/]]></text>
</define>
<define name="event4time" extract="hour, minute, seconds">
   <!--This assumes that every event starts like this: "HH:MM:SS"  You must change to fit your data!!!-->
   <text><![CDATA[^(\d{2}):(\d{2}):(\d{2})]]></text>
</define>
<timePatterns>
   <use name="event4time"/>
</timePatterns>
<datePatterns>
   <use name="file4date"/>
</datePatterns>
</datetime>

topic Date stamp in directory name in Getting Data In

Date stamp in directory name

Re: Date stamp in directory name