Splunk Search

Extract year from filename

C_HIEN
Path Finder

I have some old syslog files to index.
I'm trying to extract year from the filename and month, day, time from events (in a custom datetime.xml) without success.

Is it possible? How to do that?

Thanks

0 Karma

sbbadri
Motivator

@C_HIEN

check that filename and source field have same value. If so you can extract by using regex or field extraction

1) rex field=source "/tmp/filename-(?<fileyear>\d+)"
2) props.conf

EXTRACT-fileyear = /tmp/filename-(?<fileyear>\d+) in source

0 Karma

C_HIEN
Path Finder

Thanks for your answer. I've already seen the answers you mention but it's not exactly what i'm trying to do... I want extract the year only from filename and get day and month from events... I've temporary solved my problem with an uf on a virtual machine within the system date was changed to the year of the files to index. But i still hope there is a better solution...

0 Karma

ekost
Splunk Employee
Splunk Employee

Sorry, I missed the "day, time from events" portion of the question. I think "sbbadri" has the piece you're looking for. Good luck!

0 Karma

ekost
Splunk Employee
Splunk Employee

These: one and two older Answers posts cover the typical scenarios and provide regex samples on using a custom datetime.xml to extract the date from the file name.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...