Getting Data In

How to use the date in a CSV filename as the timestamp in events when there is no date or time field?

nikita_p
Contributor

Hi,

We are monitoring a csv file which has date included in the filename, with the filename format: abc_xxx_yz-2017-12-14.csv. I want the date "2017-12-14" to be indexed in Splunk as date. There is no timestamp or date field in events.

I tried adding with the link in Splunk Answers that suggested to add new regex and also to use existing regex in datetime.xml and made changes in props.conf, but had no luck with this.

Thank you!

0 Karma
1 Solution

woodcock
Esteemed Legend

You can get the date from the filename, but not the time (which is an absurd situation). See here:
https://answers.splunk.com/answers/320978/how-to-extract-the-timestamp-from-a-filename-at-in.html

Open a P0 case for an Enhancement Request for this capability but for now you will have to pre-pares the file and insert timestamps into the data.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can get the date from the filename, but not the time (which is an absurd situation). See here:
https://answers.splunk.com/answers/320978/how-to-extract-the-timestamp-from-a-filename-at-in.html

Open a P0 case for an Enhancement Request for this capability but for now you will have to pre-pares the file and insert timestamps into the data.

View solution in original post

0 Karma

nikita_p
Contributor

Thank you woodcock, but i anyways need only date from filename and not the time. I will try the solutions from the link which i missed.

0 Karma

nikita_p
Contributor

P.S. I want to extract date during indexing and in not search level.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

For background information, what is your configuration? Are you using UFs, heavy forwarders, are you clustered, and so on?

0 Karma

nikita_p
Contributor

Hi DalJeanis,
Thank you for reply. So we are working in a clustered environment with 16 UF's, 11 indexers, 3 SH's and 1 deployment server. CSV file is in one of these forwarders and we are indexing it in only one of these indexers.
Configuration of DATETIME_CONFIG in props.conf is as follows:-
DATETIME_CONFIG = /etc/apps/myapp/local/datetime.xml

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!