https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691926#M12509 <P>Do you mean you have loaded the csv into a lookup or that the csv has been ingested into an index and there is a source field associated with each event with the file name in?</P> Fri, 28 Jun 2024 10:32:28 GMT ITWhisperer 2024-06-28T10:32:28Z https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691925#M12508 <P>I have a event that are generated in csv format with timestamp within file name as mentioned below. Need to extract timestamp from the file and create new column as _time. Need rex query to extract the YYYY-MM-DD HH:MM:SS.</P><P>&nbsp;</P><P><A class="" title="D:\automation\miscprocess\NICEWFM_utilization_info_20240618_195509.csv" href="https://omni-splunk.optum.com/en-US/app/optum_iex_wfo/search?earliest=1716958800.000&amp;latest=1719560113.000&amp;q=search%20index%3Dcba_iex_wfm_uhc%20host%3Dapvep91562%20%22app*%22%20%20%0A%7C%20rex%20field%3D_raw%20%22%5C%22%5Cw*%5C-%5Cw*%5C-(%3F%3Cappserver%3E%5Cw*)%5C-%5Cw*%5C.%5Cw*%5C.%5Cw*%5C.%5Cw*%5C%22%5C%2C%5C%22%5Cs%2B%5CConnections%5C%3A%5Cs(%3F%3Cconnections%3E%5CS*)%5Cs%2BBusy%5Csconnections%5C%3A%5Cs(%3F%3Cbusyconnection%3E%5CS*)%5Cs%2BIdle%5Csconnections%5C%3A%5Cs(%3F%3Cidleconnections%3E%5Cd*)%5C%22%5C%2C%5C%22(%3F%3Cstatus%3E%5Cw*)%5Cs%5C-%5CsNode%5C%3A%5Cs(%3F%3CnodeORweb%3E%5Cw*)%5Cs%5CS*%5C%22%22%20%20%0A%7C%20search%20appserver%3D%22*%22%20nodeORweb%3D%22*%22%20status%3D%22*%22%20connections%3D%22*%22%20busyconnection%3D%22*%22&amp;display.page.search.mode=smart&amp;dispatch.sample_ratio=1&amp;display.page.search.tab=events&amp;display.general.type=events&amp;sid=1719570274.7666819_E8D2A4C1-90B5-4FE9-85AF-20A51B31210D#" target="_blank" rel="noopener">D:\automation\miscprocess\test_utilization_info_20240618_195509.csv</A></P> Fri, 28 Jun 2024 10:28:17 GMT https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691925#M12508 ravir_jbp 2024-06-28T10:28:17Z https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691926#M12509 <P>Do you mean you have loaded the csv into a lookup or that the csv has been ingested into an index and there is a source field associated with each event with the file name in?</P> Fri, 28 Jun 2024 10:32:28 GMT https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691926#M12509 ITWhisperer 2024-06-28T10:32:28Z https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691928#M12510 <P>The CSV files are generated by automation which generated the server status with filename when the file was generated.&nbsp; There is not timestamp generated in the file so I have to use file generation time stamp in the naming convention.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ravir_jbp_0-1719571146186.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31553iFB1B5EBBDB2AB3BE/image-size/medium?v=v2&amp;px=400" role="button" title="ravir_jbp_0-1719571146186.png" alt="ravir_jbp_0-1719571146186.png" /></span></P><P>&nbsp;</P> Fri, 28 Jun 2024 10:40:18 GMT https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691928#M12510 ravir_jbp 2024-06-28T10:40:18Z https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691930#M12511 <P>This is file content. This contnt does not have timestamp for each entries. So I have to use the file timestmap for each entries within csv file</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ravir_jbp_0-1719571415144.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31554iB4EF403FF766FD38/image-size/medium?v=v2&amp;px=400" role="button" title="ravir_jbp_0-1719571415144.png" alt="ravir_jbp_0-1719571415144.png" /></span></P><P>&nbsp;</P> Fri, 28 Jun 2024 10:44:20 GMT https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691930#M12511 ravir_jbp 2024-06-28T10:44:20Z https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691932#M12512 <LI-CODE lang="markup">| rex field=source "info_(?&lt;timestamp&gt;\d{8}_\d{6})\.csv" | eval _time=strptime(timestamp,"%Y%m%d_%H%M%S")</LI-CODE> Fri, 28 Jun 2024 10:53:16 GMT https://community.splunk.com/t5/Reporting/How-to-extract-timestamp-from-file-name/m-p/691932#M12512 ITWhisperer 2024-06-28T10:53:16Z