Getting Data In

Unable to parse timestamp from xml tag

v2k007
Engager

I am facing problem with timestamp from xml file entry.
Following is the sample tag from xml file

 <row Id="82949" UserId="3893" Name="Teacher" Date="2008-09-15T08:55:03.957" />

I have specified following timeformat and timeprefix to detect timestamp.

Timestamp format = %Y-%m-%d'T'%H:%M:%S.%3N
Timestamp prefix = \d{4}-\d{2}-\d{2}+T\d{2}:\d{2}:\d{2}.\d{3}

I am getting following error could not use strptime to parse timestamp from "" />"

I am new to Splunk, so help on this issue is really appreciated. Thanks in advance.

Tags (2)
0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

The prefix is what comes BEFORE the timestamp:

Timestamp prefix = Date="

View solution in original post

v2k007
Engager

It worked 🙂 Thanks somesoni2 and cpetterborg

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

The prefix is what comes BEFORE the timestamp:

Timestamp prefix = Date="

somesoni2
SplunkTrust
SplunkTrust

First remove single quote from time fromat and dont use time prefix.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...