Greetings---
I am in the process of building an add-on.
I am building this add-on to utilize input data stored in folders with the structure:
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.Classic.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.Classic.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.Classic.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.All-Levels.rank.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.rank.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.rank.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.rank.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.All-Levels.brawl.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Normal.brawl.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.High.brawl.csv
basedir\APP\log\activity\MLBB\TierData\01272020\en\SA\Week.Very-High.brawl.csv
I would like to use the date in the folder path (in this case, 01272020) as the Timestamp, ideally at Index Time.
I see this documentation:
https://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps
And this article:
https://answers.splunk.com/answers/94763/set-timestamp-based-on-file-source-path.html
But when I place:
EVAL-_time=strptime(file_name, "%m%d%Y")
in my props.conf, it didn't seem to work.
... View more