Extracting date

[rajdiddi]

Hi,

I have the challenge of pulling log files which come in m-d-yyyy format. Please advise how to advise the splunk forwarder to pull the above formatted log files.

thanks

Rajeshwari

[Ayn]

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configuretimestamprecognition

[Ayn]

If there is no timestamps in the file itself, Splunk will try to look at the file name to get date info from there. See http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

[karthikbalakris]

Ayn,
She is trying to ask the following:
there is a log file whose name is the date stamp itself. For Ex: 3-29-2013.log, 3-30-2013.log

added to this there are other logs in the same directory which has a date stamp sufficed to it. so *2013.log isnot possible. how can we now configure the input.conf to read these logs?

[Ayn]

Uh...well, please see my answer? What information are you missing?

[rajdiddi]

Thanks Ayn for your prompt reply, actually the case is that the log file which splunk has to open is in m-d-yyyy format, Can you provide an example of how to handle this.

Thanks in anticipation.

Rajeshwari