How to extract the timestamp from a filename to use as _time

[rayar]

Hi

we have Splunk 7.3.4 , the monitoring is running on Heavy Forwarder 

I would like to extract the _time from the file name for example source="\\ILRNACYMSRV03\WebGWAssessResultsForRPA\Bot Status Reports\11-11-2020 07.00.17\CYMULATE_URL_1111202..."

I have defined a new sourcetype as following 

props.conf

[csv_timestampeval]
BREAK_ONLY_BEFORE_DATE =
INDEXED_EXTRACTIONS = csv
INGEST_EVAL = _time==strptime(replace(replace(source,".*(?=\\\\\\)\\",""),"[\d]{4}Z_Status.csv",""),"CYMULATE_URL_%d%m%YT%H%M%S")
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 384
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

 inputs.conf

[monitor://\\ILRNACYMSRV03\WebGWAssessResultsForRPA\Bot Status Reports\11-11-2020 07.00.17\*.csv]
disabled = 0
index = test
sourcetype = csv_timestampeval
crcSalt = <SOURCE>
initCrcLength = 1024

the file is not indexed 

could you please assist  ? 

[richgalloway]

Perhaps it happened when transferring the settings to the question, but the INGEST_EVAL command has an error.  If the original contains "==" then it will fail.  Also, INGEST_EVAL goes in transforms.conf, not props.conf.

Verify the regular expressions used in INGEST_EVAL match the data.  In the example, one regex looks for "Z_Status.csv", but it's not present in the sample data.

[rayar]

Thanks a lot for your inputs  

I see the data got uploaded but with _time as the time in the file (csv) and not from the file name 

the stanza got created automatically by creating the sourcetype in GUI 

updated it manually as below

props.conf

[csv_timestampeval]
BREAK_ONLY_BEFORE_DATE =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 384
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

[csv_timestampeval]
INGEST_EVAL = _time==strptime(replace(replace(source,".*(?=\\\\\\)\\",""),"[\d]{4}Z_Status.csv",""),"CYMULATE_URL_%d%m%YT%H%M%S")