You will want to use a custom datetime.xml file. Make a copy of the default datetime.xml and rename it. In the renamed copy, look for one of the existing definitions like _masheddate and copy the whole section. It will look something like the following:
<define name="_masheddate3" extract="year, month, day">
<text><![CDATA[source::.*?/sampledata/\w+(\d{4})_(\d{2})_(\d{2})\.txt]]></text>
</define>
Change the extract= portion to reflect the components of the date and/or time that you will be pulling from the filename, in the order they exist. So your example might look something like:
You will want to use a custom datetime.xml file. Make a copy of the default datetime.xml and rename it. In the renamed copy, look for one of the existing definitions like _masheddate and copy the whole section. It will look something like the following:
<define name="_masheddate3" extract="year, month, day, hour, minute, second">
<text><![CDATA[source::.*?/yourpathgoeshere/(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})\.*\.txt]]></text>
</define>
You may have to play around with this to get the regex correct. I am just working off of an example I did a while back, that only had the date, not the time. But this should point you in the correct direction.
The last bit you need to do is point at the custom datetime.xml in your props.conf file.
[your_sourcetype_goes_here]
BREAK_ONLY_BEFORE = \(\d{2}:\d{2}:\d{2}\.\d{5}
DATETIME_CONFIG = /etc/system/local/datetime_yourcopy.xml
NO_BINARY_CHECK = true
category = Custom
I hope this is helpful. If you run into problems, take a look at the documentation around datetime.xml.
