Extracting date from file name via custom datetime.xml not working...

[sf-mike]

All,

Here is the file name and my datetime.xml config. When I apply this and try to import the data, Splunk gets stuck in preview and never shows the data.

Thanks in advance for the assist!

File Name:

ADESS_FANALL_01082014_01172014_195441.csv

Datetime.xml Config

<datetime>

<define name="_masheddate3" extract="month, day, year">
        <text><![CDATA[(?:^|source::|source:).*?ADESS_FANALL_([01]\d)([0123]\d)(20[01]\d)]]></text>
</define>

<datePatterns>
        <use name="_masheddate3"/>
</datePatterns>

</datetime>

[snehalk]

Hello @1500372,

I have followed same steps which you have mentioned in comment but am not getting any date extraction. Could you please help me

copy datetime.xml to specific directory.
cp -p /home/splunk/etc/datetime.xml /home/splunk/etc/system/local/my_datetime.xml

configure props.conf
[mysourcetype]
DATETIME_CONFIG = /etc/system/local/my_datetime.xml
...

Put your datetime configuration to my_datetime.xml (I didn't remove anything from my_datetime.xml)

restart Splunk and monitor file

Thanks in Adavance

[ramdaspr]

ADESS_FANALL_(\d{2})(\d{2})20(\d{2})

might help.

[kphillipson]

I myself have the same problem with a file name like the one above. Your xml output looks ok.

[1500372]

Did you remove all of configuration from datetime.xml? Why don't you copy datetime.xml from /etc to your directory?
I got the same situation and I resolved that like below.

1. copy datetime.xml to specific directory.
   cp -p /home/splunk/etc/datetime.xml /home/splunk/etc/system/local/my_datetime.xml

2. configure props.conf
   [mysourcetype]
   DATETIME_CONFIG = /etc/system/local/my_datetime.xml
   ...

3. Put your datetime configuration to my_datetime.xml (I didn't remove anything from my_datetime.xml)

4. restart Splunk and monitor file
   At that moment,I saw my test file name of ADESS_FANALL_01082014_01172014_195441.csv was indexed with expected timestamp. (14/01/08 xx:xx:xx.xxx)

[kphillipson]

What date is Splunk indexing it? The last modified date? That is what my file is being indexed as. I have no field inside my csv to represent time or date. Does yours?