topic Re: Parsing XML having seperate date and time tags in Getting Data In

Parsing XML having seperate date and time tags

vganjare — Mon, 28 Sep 2020 18:50:26 GMT

HI,

I am having following xml log which has two seperate tags for Date and time. I want to use Date + Time together as timestamp.

<data>
    <detail>
        <date>01-17-2015</date>
        <time>10:35:235</time>
        <country>US</country>
    </detail>
    <detail>
        <date>01-18-2015</date>
        <time>12:21:754</time>
        <country>US</country>
    </detail>
</data>

Here, I want use &ltdate&gt + &lttime&gt as TIME_PREFIX. What value of TIME_PREFIX should be set in props.conf?

Thanks.

Re: Parsing XML having seperate date and time tags

vganjare — Mon, 27 Apr 2015 09:11:09 GMT

Any way to solve this case?

Thanks!!

Re: Parsing XML having seperate date and time tags

tom_frotscher — Mon, 27 Apr 2015 09:27:35 GMT

Hi,
i can not lead you to a complete answer to this, but maybe i can give you an idea or something to search for. It looks like you need a custom datetime.xml for your sourcetype to solve this problem. The bad thing is, that there is only poorly documentation for the datetime.xml 😞

Maybe some examples can help:

http://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem

http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/

Re: Parsing XML having seperate date and time tags

woodcock — Tue, 12 May 2015 21:08:26 GMT

Use datetime.xml; to use the first date/time pair, do this:

Inside /opt/splunk/etc/apps/myApp/default/props.conf do this:

[mySourceType]
DATETIME_CONFIG = /etc/apps/myApp/default/datetime.xml

Inside /opt/splunk/etc/apps/myApp/default/datetime.xml do this:

&lt;datetime&gt;
&lt;define name="_myXMLdate" extract="month, day, year"&gt;
&lt;text&gt;&lt;![CDATA[&lt;date&gt;(\d(2)-\d(2)-(\d{4})&lt;\date&gt;]]&gt;&lt;/text&gt;
&lt;/define&gt;
&lt;define name="_myXMLtime" extract="hour, minute"&gt;
&lt;text&gt;&lt;![CDATA[&lt;time&gt;(\d{2}):(\d{2}):\d{3}&lt;/time&gt;]]&gt;&lt;/text&gt;
&lt;/define&gt;
&lt;timePatterns&gt;
&lt;use name="_myXMLtime"/&gt;
&lt;/timePatterns&gt;
&lt;datePatterns&gt;
&lt;use name="_myXMLdate"/&gt;
&lt;/datePatterns&gt;
&lt;/datetime&gt;