https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92200#M23781 <P>If you use a filename that has a date in it, that date will be used (if there are no timestamps on your events).</P> <P>For example, if you rename "dispo.log.P" to "dispo.20101020.log.P" those events should be indexed as occurring on Oct 20, 2010.</P> Fri, 29 Apr 2011 18:24:33 GMT carasso 2011-04-29T18:24:33Z https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92199#M23780 <P>I have some events, that are indexed with strange dates...</P> <PRE><CODE>17:56:58,442: htsxml2|c6d1956a-d611-47a5-97df-df0d31e1dbc7|32885|790667|483520|1|B|default|OK|65|3391 17:56:56,546: htsxml2|86bbb572-360d-4c12-8a18-0bd08ce0d7c0|17116|108051|130889|110|B|default|ERROR|-1|-1 </CODE></PRE> <P>Is there a way I can force the date to apply to the events contained in an specific file?</P> Fri, 29 Apr 2011 16:23:40 GMT https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92199#M23780 oscargarcia 2011-04-29T16:23:40Z https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92200#M23781 <P>If you use a filename that has a date in it, that date will be used (if there are no timestamps on your events).</P> <P>For example, if you rename "dispo.log.P" to "dispo.20101020.log.P" those events should be indexed as occurring on Oct 20, 2010.</P> Fri, 29 Apr 2011 18:24:33 GMT https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92200#M23781 carasso 2011-04-29T18:24:33Z https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92201#M23782 <P>Hmm. Rather than trying one really complex regex with lots of logic in it, did you try having 3 dead-simple regexes, with appropriate literals in it to match on like |B| vs |P| ? Sourcetypes can easily have more than one regex in them and 3 super-simple ones might perform better than one crazy-complicated one.</P> Mon, 16 May 2011 16:42:14 GMT https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92201#M23782 sideview 2011-05-16T16:42:14Z https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92202#M23783 <P>As a supplement to both answers provided, the method to accomplish either is to use datetime.xml. In the former, you can setup 3 different rules to use, in the latter, you can tell Splunk to get the date from the filename and the time from the event.</P> Sat, 02 May 2015 16:34:58 GMT https://community.splunk.com/t5/Splunk-Search/Add-date-to-the-timestamp-of-an-event/m-p/92202#M23783 woodcock 2015-05-02T16:34:58Z