Splunk Search

Automatic extraction of DATE from path in Splunk 6.2

Motivator

Hi

Could anyone help me with the configuration for extraction of date from path, which is done automatically?

[Detail]

I am using Splunk6.2, and I have following path/file:

/path/to/file/20150520/hostname1/logfile1.log

and there is no date info in each event.

00:00:01 key=1
00:00:02 key=2
00:00:03 key=3
00:00:04 key=4
00:00:05 key=5

With Splunk6.2, date information is automatically extracted without any manual configuration, so my event with the path above are indexed as:

15/05/20 00:00:01 key=1
15/05/20 00:00:02 key=2
15/05/20 00:00:03 key=3
15/05/20 00:00:04 key=4
15/05/20 00:00:05 key=5

This is very good, and correct indexing, but I want to know which configuration file and parameter is used to control this behavior.
I have read this, but count not find how to specify date format in the path for date.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/HowSplunkextractstimestamps
4. If no events in a source have a date, Splunk Enterprise tries to find a date in the source name or file name. Time-of-day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.) 

Could anyone explain how date is detected in the path and whether I can change this behavior for different date format as well??

Thank you in advance!

0 Karma
1 Solution

Esteemed Legend

It is done with datetime.xml which is pretty simple to understand and modify (read up on using source).

View solution in original post

0 Karma

Esteemed Legend

It is done with datetime.xml which is pretty simple to understand and modify (read up on using source).

View solution in original post

0 Karma