Getting Data In

getting event timestamp from source file name

lyndac
Contributor

I have a .csv file that I'm indexing. There is no timestamp information in the .csv file, but there is a date in the file name itself. How can I tell splunk to use the date in the SOURCE as the timestamp for each event in the file?

Ex filenames:

MY_FILE-2010-05-25.csv
MY_FILE-2010-05-26.csv
Tags (1)

lyndac
Contributor

it's using the modification time of the file.

0 Karma

Lowell
Super Champion

This should be done automatically.

You can get more info about a custom setup on this blog entry:

However, this is a pretty popular date format, so you shouldn't need a custom setup. This date should match the _isodate named format. (As seen in the default datetime.xml file.)

lyndac
Contributor

I updated my props.conf to have TIME_PREFIX=FILE- TIME_FORMAT=%Y-%m-%d MAX_TIMESTAMP_LOOKAHEAD=20 and SPLUNK used the modified date of the file as the timestamp. (not the date in the filename).

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

To make sure it gets the date from the file name, configure you TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD so that there is no possibility that it will find a date elsewhere in your event text. (Splunk is somewhat aggressive about this if you leave it on its own.) Once it fails there, it will find its way to finding the date in the file name.

0 Karma

piebob
Splunk Employee
Splunk Employee

is splunk not automatically getting the timestamp from the filename? what is being used instead?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...