Getting Data In

_time From file Name

jimjohn
Path Finder

Hi

I want splunk to populate _time field with value from file name.
for ex my file name is ABC_20140131 I want _time field with value 01/31/2014.
I looked http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/
and tried the configerations exaplined .But still I am getting _time as current time.
My changes are as follows.
etc\system\default\props.config

[host::DateFormat]
DATETIME_CONFIG =/etc/system/local/datetime.xml
TIME_PREFIX=ABC_
MAX_TIMESTAMP_LOOKAHEAD=20
TIME_FORMAT = %Y%m%d

datetime.xml

<define name="_isodate" extract="year, month, day">
       <text><![CDATA[source::ABC_\d{4}\d{2}\d{2}.*]]></text>
</define>
<datePatterns>
      <use name="_isodate"/>
</datePatterns>

Did I miss anything or can somebody give some suggestions on this.

0 Karma

kiddo258
New Member

It says that

"If no events in a source have a date, Splunk Enterprise tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)"

0 Karma

Ayn
Legend

You should check splunkd.log for errors from the timestamp processor.

0 Karma

jimjohn
Path Finder

Regular expression I have corrected to ABC_(\d{4})(\d{2})(\d{2}) to get the groups.
Myhost hame is DateFormat and and I have corrected to refereeing as
$SPLUNK_HOME/etc/system/local/datetime.xml.
But still I am getting same result(_time with current time).

0 Karma

MuS
SplunkTrust
SplunkTrust

and is your datetime.xml really in /etc/system/local or in $SPLUNK_HOME/etc/system/local/?

0 Karma

Ayn
Legend

Also is your host really called "DateFormat"??

kristian_kolb
Ultra Champion

Hi, I don't have much experience with custom datetime.xml configs, but one thing that looks suspicious is that you do not have any capturing groups in your regex, so splunk does not know which parts to extract as "year, month, day". You should probably have it more like;

ABC_(\d{4})(\d{2})(\d{2})

but there might be more things missing.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...