How to use the date in a CSV filename as the timestamp in events when there is no date or time field?

[nikita_p]

Hi,

We are monitoring a csv file which has date included in the filename, with the filename format: abc_xxx_yz-2017-12-14.csv. I want the date "2017-12-14" to be indexed in Splunk as date. There is no timestamp or date field in events.

I tried adding with the link in Splunk Answers that suggested to add new regex and also to use existing regex in datetime.xml and made changes in props.conf, but had no luck with this.

Thank you!

[woodcock · Accepted solution]

You can get the date from the filename, but not the time (which is an absurd situation). See here:
https://answers.splunk.com/answers/320978/how-to-extract-the-timestamp-from-a-filename-at-in.html

Open a P0 case for an Enhancement Request for this capability but for now you will have to pre-pares the file and insert timestamps into the data.

[nikita_p]

Thank you woodcock, but i anyways need only date from filename and not the time. I will try the solutions from the link which i missed.

[nikita_p]

P.S. I want to extract date during indexing and in not search level.

[DalJeanis]

For background information, what is your configuration? Are you using UFs, heavy forwarders, are you clustered, and so on?

[nikita_p]

Hi DalJeanis,
Thank you for reply. So we are working in a clustered environment with 16 UF's, 11 indexers, 3 SH's and 1 deployment server. CSV file is in one of these forwarders and we are indexing it in only one of these indexers.
Configuration of DATETIME_CONFIG in props.conf is as follows:-
DATETIME_CONFIG = /etc/apps/myapp/local/datetime.xml