Timestamp parsing from filename

[jackin]

Hi

I want to write the props for below logs.

Actually the logs are coming with no timestamp and the file name having the timestamp. 

These are the logs:

Message Is: https POST failed: . Status Is: Ok

Message Is: https POST successful: 200. Status Is: Ok

Changed .Pac File to http://liteway.prog2.com/proxyins/proxy_client.oac

Unable to change .Pac File to http://liteway.prog2.com/proxyins/proxy_client.oac

File name coming like 

zscalerhttp_2023-01-09-18-03-25

Can anyone help to write the props for this logs.. 

[jackin]

Yes @PickleRick 

[PickleRick]

OK. There is no setting that would allow you to extract timestamp from filename or path directly. The only way I see is to use a INGEST_EVAL functionality. See https://conf.splunk.com/files/2020/slides/PLA1154C.pdf (slide 28 onwards)

[PickleRick]

Let me get this straight - you have a separate file per each event?

[jackin]

Yes @PickleRick