You could try extracting the correct month in a new field (during index time) and then map that field onto _time (during search time).
So in props, you would have:
[testsourcetype]
TRANSFORMS-correctMonths = fixJanuar, fixFebruar, ...
EVAL-_time = strptime(correct_date,"%d.%m.%Y")
And in transforms.conf you would have:
[fixJanuar]
REGEX = (\d+). Januar (\d+)
FORMAT = correct_date::$1.01.$2
WRITE_META = true
[fixFebruar]
REGEX = (\d+). Februar (\d+)
FORMAT = correct_date::$1.02.$2
WRITE_META = true
...
This works fine for German timestamps in a format like: 03. Januar 2015
For Spanish, it needs to be adopted slightly (also to take time into consideration).
Best, Benjamin
... View more