Hi,
I have the challenge of pulling log files which come in m-d-yyyy format. Please advise how to advise the splunk forwarder to pull the above formatted log files.
thanks
Rajeshwari
If there is no timestamps in the file itself, Splunk will try to look at the file name to get date info from there. See http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps
Ayn,
She is trying to ask the following:
there is a log file whose name is the date stamp itself. For Ex: 3-29-2013.log, 3-30-2013.log
added to this there are other logs in the same directory which has a date stamp sufficed to it. so *2013.log isnot possible. how can we now configure the input.conf to read these logs?
Uh...well, please see my answer? What information are you missing?
Thanks Ayn for your prompt reply, actually the case is that the log file which splunk has to open is in m-d-yyyy format, Can you provide an example of how to handle this.
Thanks in anticipation.
Rajeshwari