Splunk Search

_time from filename using Eval

SplunkBaby
Explorer

Hi

My file name is like ABC20140321.csv
I want splunk to read _time value from this file name.
I tried to edit datetime.xml and props.config and it doesn't work out for me.
How can I achieve this using EVAL in props.config

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you read http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is your datetime.xml file really in $SPLUNK_HOME/etc or $SPLUNK_HOME/etc/system/local?
Perhaps some escape characters got dropped from your comment, but your regex doesn't look right. This works in RegExr:

\ABC(\d{4})(\d{2})(\d{2})\.csv
---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkBaby
Explorer


<![CDATA[source::.?\ABC\d{4}\d{2}\d{2}..csv]]>



[host::DateFormat2]
DATETIME_CONFIG =/etc/datetime.xml
SHOULD_LINEMERGE = FALSE

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please post your datetime.xml file and the relevant stanza from your props.conf file.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkBaby
Explorer

Yes ,unfortunately its not working for me.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.