I'm hoping someone can help out with something that's been baffling me re: using custom a datetime.xml to extract the date and time from a file's path name. I want to pull out the year, month, day, hour, and minute from the path name for a given set of data. Source would look something like this:
/path/to/data/20140416/1506/2014041615060005/[filename]
Where 2014 = year, 04 = month, 16 = day, 15 = hour, and 06 = minute. I've tried two variants of custom XML and neither are pulling out either the date nor the time (Splunk only seems to use the file's modtime no matter what I try):
<datetime>
<define name="_customdate" extract="year, month, day">
<text><![CDATA[(?:source::.*?/)(20\d{2})(\d{2})(\d{2})(?:/)]]></text>
</define>
<define name="_customtime" extract="hour, minute">
<text><![CDATA[(?:source::.*?/)(\d{2})(\d{2})(?:/)]]></text>
</define>
<timePatterns>
<use name="_customtime"/>
</timePatterns>
<datePatterns>
<use name="_customdate"/>
</datePatterns>
</datetime>
I've even tried doing this with one stanza and that doesn't work either.
<define name="_masheddate3" extract="year, month, day, hour, minute">
<text><![CDATA[(?:source:.*?/)(20\d{2})(\d{2})(\d{2})(?:/)(\d{2})(\d{2})(?:/)(\d{16})(?:/)]]></text>
</define>
Thoughts on what I might be doing wrong here? Thank you!
... View more
