Hi
My file name is like ABC20140321.csv
I want splunk to read _time value from this file name.
I tried to edit datetime.xml and props.config and it doesn't work out for me.
How can I achieve this using EVAL in props.config
Thanks
Have you read http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/?
Is your datetime.xml file really in $SPLUNK_HOME/etc or $SPLUNK_HOME/etc/system/local?
Perhaps some escape characters got dropped from your comment, but your regex doesn't look right. This works in RegExr:
\ABC(\d{4})(\d{2})(\d{2})\.csv
[host::DateFormat2]
DATETIME_CONFIG =/etc/datetime.xml
SHOULD_LINEMERGE = FALSE
Please post your datetime.xml file and the relevant stanza from your props.conf file.
Yes ,unfortunately its not working for me.