_time from filename using Eval

[SplunkBaby]

Hi

My file name is like ABC20140321.csv
I want splunk to read _time value from this file name.
I tried to edit datetime.xml and props.config and it doesn't work out for me.
How can I achieve this using EVAL in props.config

Thanks

[richgalloway]

Have you read http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/?

[richgalloway]

Is your datetime.xml file really in $SPLUNK_HOME/etc or $SPLUNK_HOME/etc/system/local?
Perhaps some escape characters got dropped from your comment, but your regex doesn't look right. This works in RegExr:

\ABC(\d{4})(\d{2})(\d{2})\.csv

[SplunkBaby]

<![CDATA[source::.?\ABC\d{4}\d{2}\d{2}..csv]]>

[host::DateFormat2]
DATETIME_CONFIG =/etc/datetime.xml
SHOULD_LINEMERGE = FALSE

[richgalloway]

Please post your datetime.xml file and the relevant stanza from your props.conf file.

[SplunkBaby]

Yes ,unfortunately its not working for me.