Getting Data In

index on regex field from source

hiddenkirby
Contributor

I have a dir of text files named like such scriptcalled_201005211317_stdout.txt

how do i index them on that date? I understand splunk already tries to pull the date from the source.. but if i can specify a regex i would prefer that... and i think it would be faster.

TIA,

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

See here: http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

The default Splunk settings do many different formats, but you can be as specific as you like.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

See here: http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

The default Splunk settings do many different formats, but you can be as specific as you like.

hiddenkirby
Contributor

Thank you! 🙂

0 Karma

Lowell
Super Champion

Timestamp extraction from source is controlled in the $SPLUNK_HOME/etc/datetime.xml file. Search the file for "source::" and you'll see the formats supported.

I think this is your only option. And regexes are definitely involved, although probably not in the way you were thinking.

0 Karma

hiddenkirby
Contributor
0 Karma

hiddenkirby
Contributor

or even something ot format it?
[source::/Applications/splunk/var/spool/splunk] TIME_PREFIX = (\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2}) FORMAT = $1/$2/$3 $4:$5:$6

0 Karma

hiddenkirby
Contributor

or would i do something similar to this in props.conf [source::/Applications/splunk/var/spool/splunk]
TIME_PREFIX = \d{14}

0 Karma

hiddenkirby
Contributor

can i create a _masheddate3 w/ my very specific regex?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...