Getting Data In

Date stamp in directory name

Path Finder

How can I configure splunk to index or accept the datestamp in the name of directories?
The events only have time stamps.


drwxr-xr-x 2 test test 57344 May 13 03:35 20120513
drwxr-xr-x 2 test test 57344 May 14 21:21 20120514
drwxr-xr-x 2 test test 57344 May 15 18:31 20120515

I'm having issues when I restart the forwarder and it doesn't recognize the date time in the meta data.

Tags (1)
0 Karma

Esteemed Legend

I am assuming that you are getting the date from the directory but the time from the events. You do it like this:


DATETIME_CONFIG = /etc/apps/myApp/default/datetime.xml


<define name="file4date" extract="year, month, day">
<define name="event4time" extract="hour, minute, seconds">
   <!--This assumes that every event starts like this: "HH:MM:SS"  You must change to fit your data!!!-->
   <use name="event4time"/>
   <use name="file4date"/>
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...