I have text file 20170701.txt where 2017-year, 07-month and 01-date.
This file is coming from the universal forwarder, below is my inputs.conf (C:\Program Files\SplunkUniversalForwarder\etc\system\local)
crcSalt = <SOURCE>
In the heavy forwarder side i wrote the datetime.xml and props.conf (C:\Program Files\Splunk\etc\apps\myapp\local)
<define name="_mydatetime" extract="year, month, day">
DATETIME_CONFIG = /etc/apps/myapp/local/datetime.xml
After the doing changes i have restarted both UF and HF.
The problem is am not getting "20170701" date as indexing time in Splunk.
And in Splunkd.log am getting below error
07-05-2017 16:13:54.893 +0530 ERROR AggregatorMiningProcessor - Uncaught exception in Aggregator, skipping an event: Error parsing regex XML file: C:\Program Files\Splunk\etc\apps\myapp\local\datetime.xml - Couldn't find 'timePatterns' in config data for AggregatorProcessor. - data_source="C:\sampletestfile\20170701.txt"
Can any one please guide me where am wrong.
Thanks in Advance
... View more