Splunk Search

Automatic extraction of DATE from path in Splunk 6.2

melonman
Motivator

Hi

Could anyone help me with the configuration for extraction of date from path, which is done automatically?

[Detail]

I am using Splunk6.2, and I have following path/file:

/path/to/file/20150520/hostname1/logfile1.log

and there is no date info in each event.

00:00:01 key=1
00:00:02 key=2
00:00:03 key=3
00:00:04 key=4
00:00:05 key=5

With Splunk6.2, date information is automatically extracted without any manual configuration, so my event with the path above are indexed as:

15/05/20 00:00:01 key=1
15/05/20 00:00:02 key=2
15/05/20 00:00:03 key=3
15/05/20 00:00:04 key=4
15/05/20 00:00:05 key=5

This is very good, and correct indexing, but I want to know which configuration file and parameter is used to control this behavior.
I have read this, but count not find how to specify date format in the path for date.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/HowSplunkextractstimestamps
4. If no events in a source have a date, Splunk Enterprise tries to find a date in the source name or file name. Time-of-day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.) 

Could anyone explain how date is detected in the path and whether I can change this behavior for different date format as well??

Thank you in advance!

0 Karma
1 Solution

woodcock
Esteemed Legend

It is done with datetime.xml which is pretty simple to understand and modify (read up on using source).

View solution in original post

0 Karma

woodcock
Esteemed Legend

It is done with datetime.xml which is pretty simple to understand and modify (read up on using source).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...