The closest that you can get is to encode the date in the filename as a literal string. Once you do this (you can use a non-splunk custom pre-parser script to do this if you have to), then you can use datetime.xml to pull the date from the filename but the time from each event like this:
<datetime>
<!--EACH FILENAME HAS THE FOLLOWING FORMAT:
"*-YYMMDD-hh_mm" Where
"YY" is a two digit number representing the year.
"MM" is a two digit number representing the month.
"DD" is a two digit number representing the day of the month.
"hh" is a two digit number representing the hour of the day (24 hour).
"mm" is a two digit number representing the number of minutes after the hour.-->
<define name="datefromfile" extract="year, month, day">
<text><![CDATA[source::.*?-(\d{2})(\d{2})(\d{2}]]>-</text>
</define>
<!--EACH EVENT HAS THE FOLLOWING FORMAT:
#Position|Description
# 1-2 |Time of day-hours
# 3-4 |Time of day-minutes
# 5-6 |Time of day-seconds
<define name="timefromevents" extract="hour, minute,second">
<text><![CDATA[^(\d{2})(\d{2})(\d{2})]]></text>
</define>
<timePatterns>
<use name="timefromevents"/>
</timePatterns>
<datePatterns>
<use name="datefromfile"/>
</datePatterns>
</datetime>
... View more
