How to use ingest-eval when filename always changing ?

[mah]

Hi,

How can I index multiple file with only one INGEST-EVAL ?

For instance, I have a filename that can change : 

prod-1-%d%m%Y%H%M%S.txt

prod-2-%d%m%Y%H%M%S.txt

prod-3-%d%m%Y%H%M%S.txt

I tried this :

[timestampeval]
INGEST_EVAL = _time=strptime(replace(source,".*(?=/)/",""),"prod-.-%d%m%Y%H%M%S.txt")

But doesn't work... 

[mthomas_splunk]

INGEST_EVAL can be used for many different purposes. I believe in this case, you are wanting to take a timestamp from the file name, and use it for each event ingested. You also want the logic to ignore "prod-x-" (where 'x' is a positive integer).

The following entry in your transforms.conf should do the trick: 

INGEST_EVAL = _time=strptime(replace(source,"(^.*(?=/)/prod-\d+-|\.txt$)",""),"%d%m%Y%H%M%S")

[mah]

Hi @mthomas_splunk ,

It is exactly what I try to set up in my case. 

I tested your answer and works great ! 

Thanks for your help !