How to extract the date (yymmddHH) from the file name and time (MM:SS) from events in the file as the event _time?

[astalv]

Hi everyone!

I have a log with a strange format. In the filename, it is a full date and an hour of event and the minute:second are in the events inside the file, line by line.

For example:
File name: 16110810.log // it means yymmddHH

Lines:
10:01 xxx xxx xxx // it means MM:SS
10:02 yyy yyy yyy // it means MM:SS

Does anybody have an ideas how to extract time correctly other than in search time with eval?

I tried changing datetime.xml, but I have also hour stamp in a file name and it doesn't worked. Now I'm thinking about overwriting the _time field at index time, but not sure it is possible. Maybe any workaround? I have this data in a dedicated index and with its own sourcetype, of course.

[hunters_splunk]

Hi astalv,

I don't think you can extract the timestamps info correctly from both your source file and raw data at index time. Of course, you can use eval at search time to achieve this, as you already know.

You can overwrite event metadata at parsing time for specific sourcetypes, but this applies only to these metadata: host, source, sourcetype. An example below:

props.conf
[source::udp:514]
TRANSFORMS = custom_sourcetyper

transforms.conf
[custom_sourcetyper]
SOURCE_KEY = _raw
REGEX = Custom$
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::custom_log

Hope it helps. Thanks!
Hunter