getting event timestamp from source file name

[lyndac]

I have a .csv file that I'm indexing. There is no timestamp information in the .csv file, but there is a date in the file name itself. How can I tell splunk to use the date in the SOURCE as the timestamp for each event in the file?

Ex filenames:

MY_FILE-2010-05-25.csv
MY_FILE-2010-05-26.csv

[lyndac]

it's using the modification time of the file.

[Lowell]

This should be done automatically.

You can get more info about a custom setup on this blog entry:

• http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

However, this is a pretty popular date format, so you shouldn't need a custom setup. This date should match the _isodate named format. (As seen in the default datetime.xml file.)

[lyndac]

I updated my props.conf to have TIME_PREFIX=FILE- TIME_FORMAT=%Y-%m-%d MAX_TIMESTAMP_LOOKAHEAD=20 and SPLUNK used the modified date of the file as the timestamp. (not the date in the filename).

[gkanapathy]

To make sure it gets the date from the file name, configure you TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD so that there is no possibility that it will find a date elsewhere in your event text. (Splunk is somewhat aggressive about this if you leave it on its own.) Once it fails there, it will find its way to finding the date in the file name.

[piebob]

is splunk not automatically getting the timestamp from the filename? what is being used instead?