Getting Data In

How to use folder name/path as TimeStamp

p3hndrx
Explorer

Greetings---
I am in the process of building an add-on.
I am building this add-on to utilize input data stored in folders with the structure:

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.Classic.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.Classic.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.Classic.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.All-Levels.rank.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.rank.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.rank.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.rank.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.All-Levels.brawl.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.brawl.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.brawl.csv

basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.brawl.csv

I would like to use the date in the folder path (in this case, 01272020) as the Timestamp, ideally at Index Time.

I see this documentation:
https://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

And this article:
https://answers.splunk.com/answers/94763/set-timestamp-based-on-file-source-path.html

But when I place:

EVAL-_time=strptime(file_name, "%m%d%Y")

in my props.conf, it didn't seem to work.

0 Karma
1 Solution

nickhills
Ultra Champion

Ideally you need to extract the part of the path that contains a date into a field first, and then run the eval against that.
Assuming file_name is already extracted..

..your search..|rex file_name (?P<stringDate>\d{8})|eval _time=strptime(stringDate, "%m%d%Y")

Give that a go.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Ideally you need to extract the part of the path that contains a date into a field first, and then run the eval against that.
Assuming file_name is already extracted..

..your search..|rex file_name (?P<stringDate>\d{8})|eval _time=strptime(stringDate, "%m%d%Y")

Give that a go.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...