Splunk Enterprise

How to extract the timestamp from a filename to use as _time

rayar
Contributor

Hi

we have Splunk 7.3.4 , the monitoring is running on Heavy Forwarder 

 

I would like to extract the _time from the file name for example source="\\ILRNACYMSRV03\WebGWAssessResultsForRPA\Bot Status Reports\11-11-2020 07.00.17\CYMULATE_URL_1111202..."

I have defined a new sourcetype as following 

props.conf

 

[csv_timestampeval]
BREAK_ONLY_BEFORE_DATE =
INDEXED_EXTRACTIONS = csv
INGEST_EVAL = _time==strptime(replace(replace(source,".*(?=\\\\\\)\\",""),"[\d]{4}Z_Status.csv",""),"CYMULATE_URL_%d%m%YT%H%M%S")
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 384
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

 inputs.conf

 

[monitor://\\ILRNACYMSRV03\WebGWAssessResultsForRPA\Bot Status Reports\11-11-2020 07.00.17\*.csv]
disabled = 0
index = test
sourcetype = csv_timestampeval
crcSalt = <SOURCE>
initCrcLength = 1024

 

the file is not indexed 

could you please assist  ? 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps it happened when transferring the settings to the question, but the INGEST_EVAL command has an error.  If the original contains "==" then it will fail.  Also, INGEST_EVAL goes in transforms.conf, not props.conf.

Verify the regular expressions used in INGEST_EVAL match the data.  In the example, one regex looks for "Z_Status.csv", but it's not present in the sample data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rayar
Contributor

Thanks a lot for your inputs  

I see the data got uploaded but with _time as the time in the file (csv) and not from the file name 

 

the stanza got created automatically by creating the sourcetype in GUI 

updated it manually as below

 

props.conf

 

[csv_timestampeval]
BREAK_ONLY_BEFORE_DATE =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 384
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

 

[csv_timestampeval]
INGEST_EVAL = _time==strptime(replace(replace(source,".*(?=\\\\\\)\\",""),"[\d]{4}Z_Status.csv",""),"CYMULATE_URL_%d%m%YT%H%M%S")

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...