topic Re: _time from filename using Eval in Splunk Search

_time from filename using Eval

SplunkBaby — Wed, 30 Apr 2014 11:07:19 GMT

My file name is like ABC20140321.csv
I want splunk to read _time value from this file name.
I tried to edit datetime.xml and props.config and it doesn't work out for me.
How can I achieve this using EVAL in props.config

Thanks

Re: _time from filename using Eval

richgalloway — Wed, 30 Apr 2014 11:51:34 GMT

Have you read http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/?

Re: _time from filename using Eval

SplunkBaby — Wed, 30 Apr 2014 11:59:14 GMT

Yes ,unfortunately its not working for me.

Re: _time from filename using Eval

richgalloway — Wed, 30 Apr 2014 12:04:19 GMT

Please post your datetime.xml file and the relevant stanza from your props.conf file.

Re: _time from filename using Eval

SplunkBaby — Mon, 28 Sep 2020 16:30:09 GMT

<![CDATA[source::.?\ABC\d{4}\d{2}\d{2}..csv]]>

[host::DateFormat2]
DATETIME_CONFIG =/etc/datetime.xml
SHOULD_LINEMERGE = FALSE

Re: _time from filename using Eval

richgalloway — Mon, 28 Sep 2020 16:30:11 GMT

Is your datetime.xml file really in $SPLUNK_HOME/etc or $SPLUNK_HOME/etc/system/local?
Perhaps some escape characters got dropped from your comment, but your regex doesn't look right. This works in RegExr:

\ABC(\d{4})(\d{2})(\d{2})\.csv