Hi
Could anyone help me with the configuration for extraction of date from path, which is done automatically?
[Detail]
I am using Splunk6.2, and I have following path/file:
/path/to/file/20150520/hostname1/logfile1.log
and there is no date info in each event.
00:00:01 key=1
00:00:02 key=2
00:00:03 key=3
00:00:04 key=4
00:00:05 key=5
With Splunk6.2, date information is automatically extracted without any manual configuration, so my event with the path above are indexed as:
15/05/20 00:00:01 key=1
15/05/20 00:00:02 key=2
15/05/20 00:00:03 key=3
15/05/20 00:00:04 key=4
15/05/20 00:00:05 key=5
This is very good, and correct indexing, but I want to know which configuration file and parameter is used to control this behavior.
I have read this, but count not find how to specify date format in the path for date.
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/HowSplunkextractstimestamps
4. If no events in a source have a date, Splunk Enterprise tries to find a date in the source name or file name. Time-of-day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.)
Could anyone explain how date is detected in the path and whether I can change this behavior for different date format as well??
Thank you in advance!
It is done with datetime.xml
which is pretty simple to understand and modify (read up on using source
).
It is done with datetime.xml
which is pretty simple to understand and modify (read up on using source
).