topic Re: Unable to parse timestamp from xml tag in Getting Data In

Unable to parse timestamp from xml tag

v2k007 — Sun, 16 Nov 2014 01:15:22 GMT

I am facing problem with timestamp from xml file entry.
Following is the sample tag from xml file

 <row Id="82949" UserId="3893" Name="Teacher" Date="2008-09-15T08:55:03.957" />

I have specified following timeformat and timeprefix to detect timestamp.

Timestamp format = %Y-%m-%d'T'%H:%M:%S.%3N
Timestamp prefix = \d{4}-\d{2}-\d{2}+T\d{2}:\d{2}:\d{2}.\d{3}

I am getting following error could not use strptime to parse timestamp from "" />"

I am new to Splunk, so help on this issue is really appreciated. Thanks in advance.

somesoni2 — Sun, 16 Nov 2014 02:43:20 GMT

First remove single quote from time fromat and dont use time prefix.

cpetterborg — Sun, 16 Nov 2014 03:12:41 GMT

The prefix is what comes BEFORE the timestamp:

Timestamp prefix = Date="

v2k007 — Sun, 16 Nov 2014 08:16:43 GMT

It worked 🙂 Thanks somesoni2 and cpetterborg