I have a file name that contains such timestamp:
year(16) month(11) date(28)
how do i tell Splunk to use that date for indexing?
I have looked at many answers online including blogs, none of them worked. Maybe my regex is wrong?
....(default datetime setting in between) .....
this post says the user created a splunk support case and the answer was - extracting a full timestamp from a filename is not currently supported in Splunk. There was lot of discussion on this post, please check it.
right, I understand it can not use the time and i only care about the date.
this was my regex in my_datetime.xml, please let me know if i did anything wrong
and i also changed the location of my_datetime.xml file path from local to default
am i missing anything?