setting the timestamp from source file name instead of the date in the events

[imrago]

I have log files with file names like:

report-2012-02-25.csv
report-2012-02-26.csv

In those reports only some events have a date field.

How could I force Splunk to use the date extracted from the file name instead of the dates recognized in the events for all of them?

[gkanapathy · Accepted solution]

http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

[imrago]

Thank you for that, but found another problem. Time field is needed to be present in the events based on the documentation:

1. If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)