My file name is like ABC20140321.csv
I want splunk to read _time value from this file name.
I tried to edit datetime.xml and props.config and it doesn't work out for me.
How can I achieve this using EVAL in props.config
Is your datetime.xml file really in $SPLUNK_HOME/etc or $SPLUNK_HOME/etc/system/local?
Perhaps some escape characters got dropped from your comment, but your regex doesn't look right. This works in RegExr:
--- If this reply helps you, an upvote would be appreciated.