Hi..
I have a source files with the following names (data_2013-08-2119.21.04.log) , here 2013-08-2119.21.04 is the timestamp that log is created. Now i need for all the events in this log to have the time as 2013-08-2119.21.04 i.e _time should be 2013-08-2119.21.04 and it should be based on the source files... is this possible in splunk ??
Can any pls help here..??
Thanks Ayn..even i found this..Is there any example for thi s case pls..i am looking for a syntax and example of this scenerio...