I have read multiple blogs and answers and couldn't find anything that helps.
The filename will be something like this blah_blah_blah....161030.txt
I have checked my regex on regex101 and it works perfectly.
This is what I have,
props.conf
[filedate]
DATETIME_CONFIG = /etc/system/local/datetime.xml
category= Date_time
CHARSET=AUTO
disabled=false
pulldown_type = true
Datetime.xml
<datetime>
<define name="_masheddate3" extract="year, month, day,">
<text> ![CDATA[(?:^|source:|source::).*?([123]\d)([01]\d)([0123]\d)[^0-9]]] </text>
</define>
<datePatterns>
<use name="_masheddate3"/>
</datePatterns>
</datetime>
And this the error message that i get from Splunkd.log
11-03-2016 12:44:36.860 -0400 ERROR AggregatorMiningProcessor - Uncaught exception in Aggregator, skipping an event: Error parsing regex XML file: C:\Program Files\Splunk\etc\system\local\datetime.xml - Couldn't find 'timePatterns' in config data for AggregatorProcessor. - data_source="C:\Users\ComputerName\Documents\Test2\blah_blah161030.txt", data_host="local", data_sourcetype="filedate"</code>
11-03-2016 12:44:36.860 -0400 ERROR AggregatorMiningProcessor - Uncaught exception in Aggregator, skipping an event: Error parsing regex XML file: C:\Program Files\Splunk\etc\system\local\datetime.xml - Couldn't find 'timePatterns' in config data for AggregatorProcessor. - data_source="C:\Users\ComputerName\Documents\Test2\blah_blah161030.txt", data_host="local", data_sourcetype="filedate"
I know Props.conf is working by looking at this error message, so the only issue is in datetime.xml...
The time is irrelevant to me. How do I make Splunk just get the date and ignore the time? If there is anyone that had success in this, please let me know!
... View more