Getting Data In

How to extract date field from the filename in Splunk and assign _time value to that in indexing phase


Hello Everyone,

I have text file 20170701.txt where 2017-year, 07-month and 01-date.

This file is coming from the universal forwarder, below is my inputs.conf (C:\Program Files\SplunkUniversalForwarder\etc\system\local)

crcSalt = <SOURCE>

In the heavy forwarder side i wrote the datetime.xml and props.conf (C:\Program Files\Splunk\etc\apps\myapp\local)

  <define name="_mydatetime" extract="year, month, day">
    <use name="_mydatetime"/>
    <use name="_mydatetime"/>


DATETIME_CONFIG = /etc/apps/myapp/local/datetime.xml

After the doing changes i have restarted both UF and HF.

The problem is am not getting "20170701" date as indexing time in Splunk.

And in Splunkd.log am getting below error

07-05-2017 16:13:54.893 +0530 ERROR AggregatorMiningProcessor - Uncaught exception in Aggregator, skipping an event: Error parsing regex XML file: C:\Program Files\Splunk\etc\apps\myapp\local\datetime.xml - Couldn't find 'timePatterns' in config data for AggregatorProcessor. - data_source="C:\sampletestfile\20170701.txt"

Can any one please guide me where am wrong.

Thanks in Advance


There's no tag at the start of your xml file, which is probably causing the whole thing to be skipped.

0 Karma


Hello jplumsdaine22,
Thanks for reply, after adding tag in code, still am getting same error. could you please help me here?

0 Karma


Did you ever get help on this?

0 Karma

Esteemed Legend

Why are you using Heavy Forwarder here? It seems to add no benefit and therefore makes no sense.

0 Karma


Hello woodcock,

Yes,in current scenario there is no need, but we have this as current environment, and also we have some files where we are using parsing. but not for this source.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...