- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to extract the timestamp from a filename to use as _time
Hi
we have Splunk 7.3.4 , the monitoring is running on Heavy Forwarder
I would like to extract the _time from the file name for example source="\\ILRNACYMSRV03\WebGWAssessResultsForRPA\Bot Status Reports\11-11-2020 07.00.17\CYMULATE_URL_1111202..."
I have defined a new sourcetype as following
props.conf
[csv_timestampeval]
BREAK_ONLY_BEFORE_DATE =
INDEXED_EXTRACTIONS = csv
INGEST_EVAL = _time==strptime(replace(replace(source,".*(?=\\\\\\)\\",""),"[\d]{4}Z_Status.csv",""),"CYMULATE_URL_%d%m%YT%H%M%S")
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 384
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1
inputs.conf
[monitor://\\ILRNACYMSRV03\WebGWAssessResultsForRPA\Bot Status Reports\11-11-2020 07.00.17\*.csv]
disabled = 0
index = test
sourcetype = csv_timestampeval
crcSalt = <SOURCE>
initCrcLength = 1024
the file is not indexed
could you please assist ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Perhaps it happened when transferring the settings to the question, but the INGEST_EVAL command has an error. If the original contains "==" then it will fail. Also, INGEST_EVAL goes in transforms.conf, not props.conf.
Verify the regular expressions used in INGEST_EVAL match the data. In the example, one regex looks for "Z_Status.csv", but it's not present in the sample data.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks a lot for your inputs
I see the data got uploaded but with _time as the time in the file (csv) and not from the file name
the stanza got created automatically by creating the sourcetype in GUI
updated it manually as below
props.conf
[csv_timestampeval]
BREAK_ONLY_BEFORE_DATE =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 384
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1
[csv_timestampeval]
INGEST_EVAL = _time==strptime(replace(replace(source,".*(?=\\\\\\)\\",""),"[\d]{4}Z_Status.csv",""),"CYMULATE_URL_%d%m%YT%H%M%S")
