Hello,
Although I clicked "Include only new or changed entries" check box, all RSS feeds continue to be imported in Splunk. Can you help me to get only new or changed RSS data?
Thanks,
The RSS feed (https://www.usom.gov.tr/rss/zararli-baglanti.rss) doesn't include a date field for the entries which is why the app isn't filtering them. The entries need to have a pubDate element to support automatic filtering.
You could handle this in search. For example, below is a search that deduplicates the entries and uses the time field to indicate when the item was first observed.
source="syndication://answers_239153" | stats earliest(_time) as earliest latest(_time) as last_seen by title | convert ctime(earliest) ctime(last_seen) | sort title
The RSS feed (https://www.usom.gov.tr/rss/zararli-baglanti.rss) doesn't include a date field for the entries which is why the app isn't filtering them. The entries need to have a pubDate element to support automatic filtering.
You could handle this in search. For example, below is a search that deduplicates the entries and uses the time field to indicate when the item was first observed.
source="syndication://answers_239153" | stats earliest(_time) as earliest latest(_time) as last_seen by title | convert ctime(earliest) ctime(last_seen) | sort title
Could you provide the URL if the feed is public? I can debug it from there. Otherwise, I can provide some guidance based on the logs.
https://www.usom.gov.tr/rss/zararli-baglanti.rss
I would be so glad.
Thanks,