Splunk Search

Time and Date in two different places within my events

jpelletier_splu
Splunk Employee
Splunk Employee

Here is part of what my events that are in xml format look like:

Blockquote``_id="1767282" _uuid="0D981036-9B9C-4841-969E-1DC5755039CC" _position="1767282" _address="http://xml.mydata_data.com4-ku6q/1767282">< date_action>2015-08-08T00:00:00< /date_action>< time_action>23:58:00< /time_action>

I am trying to work in props.conf to have Splunk identify the times and dates that that can be identified in the log file < date_action> & < time_action> (I INSERTED A SPACE AFTER EACH < so those labels appear in this post) . Should I extract those labels/identifiers instead? Or should I be using some sort of regex in Tranforms.conf + Props.conf?? I noticed that at the end of each date is a T00:00 which could be the culprit that is confusing the the time stamp I would like to configure/use 23:58:00 with the date. The log

any help would be appreciated, thanks!

Tags (1)
0 Karma
1 Solution

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi

For that format you should specify the following in props.conf

[ mysourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT00:00:00%H:%M:%S
TIME_PREFIX=_address="
MAX_TIMESTAMP_LOOKAHEAD=128

Let me know if it works. If it does, please mark the question as answered.

j

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Add following timestamp related attributes to your props.conf for the sourcetype

[Yoursourcetype]
....Current entries.....
TIME_PREFIX=_address=\"
TIME_FORMAT=%Y-%m-%dT00:00:00%H:%M:%S
0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi

For that format you should specify the following in props.conf

[ mysourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT00:00:00%H:%M:%S
TIME_PREFIX=_address="
MAX_TIMESTAMP_LOOKAHEAD=128

Let me know if it works. If it does, please mark the question as answered.

j

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...