Splunk Enterprise

How to use ingest-eval when filename always changing ?



How can I index multiple file with only one INGEST-EVAL ?

For instance, I have a filename that can change : 




I tried this :

INGEST_EVAL = _time=strptime(replace(source,".*(?=/)/",""),"prod-.-%d%m%Y%H%M%S.txt")

But doesn't work... 

Labels (1)
Tags (1)
0 Karma

Splunk Employee
Splunk Employee

INGEST_EVAL can be used for many different purposes. I believe in this case, you are wanting to take a timestamp from the file name, and use it for each event ingested. You also want the logic to ignore "prod-x-" (where 'x' is a positive integer).

The following entry in your transforms.conf should do the trick: 


INGEST_EVAL = _time=strptime(replace(source,"(^.*(?=/)/prod-\d+-|\.txt$)",""),"%d%m%Y%H%M%S")


Tags (2)
0 Karma


Hi @mthomas_splunk ,

It is exactly what I try to set up in my case. 

I tested your answer and works great ! 

Thanks for your help !  

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...