<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to extract the timestamp from an HTML file? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-extract-the-timestamp-from-an-HTML-file/m-p/153253#M31180</link>
    <description>&lt;P&gt;I would avoid using any kind of tag notation within TIME_PREFIX. Have you tried just as below? &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;TIME_PREFIX= title="
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%N%Z
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Tue, 23 Dec 2014 04:16:18 GMT</pubDate>
    <dc:creator>alacercogitatus</dc:creator>
    <dc:date>2014-12-23T04:16:18Z</dc:date>
    <item>
      <title>How to extract the timestamp from an HTML file?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-extract-the-timestamp-from-an-HTML-file/m-p/153252#M31179</link>
      <description>&lt;P&gt;Howdy. I'm trying to index an HTML file, and I can not, for the life of me, get the timestamp to extract when using the preview. Here's the event:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;abbr class="dt" title="2013-05-27T04:24:58.979Z"&amp;gt;May 27, 2013, 4:24:58 AM
GMT&amp;lt;/abbr&amp;gt;:
&amp;lt;cite class="sender vcard"&amp;gt;&amp;lt;a class="tel" href="tel:+*******"&amp;gt;&amp;lt;span class="fn"&amp;gt;+**********&amp;lt;/span&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/cite&amp;gt;:
&amp;lt;q&amp;gt;Yeah, I'll be there&amp;lt;/q&amp;gt;&amp;lt;/div&amp;gt; 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And here's what I'm using for settings.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;TIME_FORMAT = %Y-%m-%dT%H:%M:%S
TIME_PREFIX = &amp;lt;abbr class="\w+" title="
MAX_TIMESTAMP_LOOKAHEAD = 19
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;It's just not finding the timestamp at all. Any idea why? I've tried a few other iterations, even going so far as to make the prefix &amp;lt;.*&amp;gt;, and setting the time format to match the second timestamp; still nothing. I'm getting pretty frustrated.&lt;/P&gt;</description>
      <pubDate>Thu, 18 Dec 2014 14:34:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-extract-the-timestamp-from-an-HTML-file/m-p/153252#M31179</guid>
      <dc:creator>tfitzgerald_col</dc:creator>
      <dc:date>2014-12-18T14:34:34Z</dc:date>
    </item>
    <item>
      <title>Re: How to extract the timestamp from an HTML file?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-extract-the-timestamp-from-an-HTML-file/m-p/153253#M31180</link>
      <description>&lt;P&gt;I would avoid using any kind of tag notation within TIME_PREFIX. Have you tried just as below? &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;TIME_PREFIX= title="
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%N%Z
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 23 Dec 2014 04:16:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-extract-the-timestamp-from-an-HTML-file/m-p/153253#M31180</guid>
      <dc:creator>alacercogitatus</dc:creator>
      <dc:date>2014-12-23T04:16:18Z</dc:date>
    </item>
  </channel>
</rss>

