topic DateTime extraction from an XML file - Why are dates not in sequence? in Getting Data In

DateTime extraction from an XML file - Why are dates not in sequence?

SpockGin — Wed, 10 May 2023 20:01:06 GMT

I am doing some lab work and am struggling with a date/time extraction for an XML file.

There is *some sucess as I can get the date out of the data (between two <ActionDate> tags) though when I look at the ordering of the data, it is out of sequence.

I am doing this on a Stand Alone instance via the front end. I am wondering if something is off in my config, can any one advise?

SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)\s*<Interceptor> BREAK_ONLY_BEFORE_DATE=null NO_BINARY_CHECK=true CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=15 TIME_FORMAT=%F TIME_PREFIX=<ActionDate> kv_mode=xml pulldown_type=true TZ=America/New_York

Here is a screenshot too with how it is showing. Note the dates are not in sequence. What could be causing this?

Thanks

Re: DateTime extraction from an XML file - Dates not in sequence

gcusello — Wed, 10 May 2023 10:51:08 GMT

Hi @SpockGin,

add "INDEXED_EXTRACTIONS = XML" to your props.conf, so you can define the field to use as timestamp.

Ciao.

Giuseppe

Re: DateTime extraction from an XML file - Dates not in sequence

SpockGin — Wed, 10 May 2023 11:06:24 GMT

Hi @gcusello

Thanks for your reply, I have to check, as I have looked at that though the docs do not specify XML as an option.

https://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata

INDEXED_EXTRACTIONS = <CSV|W3C|TSV|PSV|JSON|HEC>

Thanks

Re: DateTime extraction from an XML file - Dates not in sequence

SpockGin — Wed, 10 May 2023 11:54:23 GMT

Further to this, I can confirm this works in the app.

The dates being out of sequence is just when doing the front end extractions (as it is not yet indexed). In the app it works properly.

Thanks

Re: DateTime extraction from an XML file - Dates not in sequence

gcusello — Wed, 10 May 2023 11:55:23 GMT

Hi @SpockGin,

sorry: xml isn't in structured indexed!

anyway the TIMR_PREFIX and TIME_FORMAT are wrong, please try this:

TIME_FORMAT=%Y-%m-%d TIME_PREFIX=\<ActionDate\>

Ciao.

Giuseppe