Getting Data In

How to extract the date from a filename at index-time to use as _time?

Path Finder

I want to extract the year, month and day from the file name. The file name format is: aa_1_20180701.csv OR aa_2_20180702.csv
I configured it in /etc/apps/myapp/local/datetime.xml as follows:(I use a Splunkforwarder to forward data,and I also configue datetime.xml,and put the datetime.xml in $SplunkForwarder/etc/apps/myapp/local/datetime.xml)

<define name="_dateconfim" extract="year, month, day">

      <use name="_dateconfim"/>
<use name="_dateconfim"/>


My sourcetype configue is:

DATETIME_CONFIG = /etc/apps/myapp/local/datetime.xml
category = Structured
disabled = false
pulldown_type = true

But the time I got was always modification time. alt textalt text
what should I do ?
I wang to get time which in the filename

0 Karma

Splunk Employee
Splunk Employee

It looks like you are on the good track.
- maybe a typo somewhere
- make sure that you put the props.conf and custom_datatime.xml in the indexers (or heavy forwarders if any)

there is a bit of documentation on the formats here :

0 Karma

Splunk Employee
Splunk Employee

A small remark on the datetime .

Usually, I avoid reusing the name datetime.xml for my file, because of the merging process between apps.
I would recommend to create your own file mydatetime.xml to make sure that the config is not picking another default one.

0 Karma


@WXY I am not sure if you have tried defining Timestamp extraction (only Time part) from your events and Splunk should be able to pull the date from Filename. Refer to an older answer:

If you can provide some sample events with Time/Time format we would be able to assist you better.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma



did you managed to get it working ? I am having same issue.


0 Karma


@agoyal - please do not revive dead posts - it is more effective to ask your new question and put a link to the old post in your own, new question.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...