topic Re: Is it possible to set a conditional timestamp from indexed events? in Getting Data In

Is it possible to set a conditional timestamp from indexed events?

amanno — Tue, 29 Sep 2020 14:44:03 GMT

I have an XML file with "items" that are being indexed. The issue is that these "items" can possibly have two different timestamps. At the time of indexing I want to specify the timestamp conditional on which one is available. So every item at least has timestamp1
and only some have timestamp2 but if timestamp2 exists I want that to be the timestamp seen by splunk if not then I want timestamp1. The TIME_PREFIXES would be different but I cannot seem to find a way to make the TIME_PREFIX conditional.

Any ideas?

Re: Is it possible to set a conditional timestamp from indexed events?

sbbadri — Fri, 30 Jun 2017 16:03:40 GMT

can you post some sample events.

Re: Is it possible to set a conditional timestamp from indexed events?

amanno — Fri, 30 Jun 2017 16:10:19 GMT

Example:

<item1 name='foo'>
    <timestamp1>2017-Jun-30 22:10:50</timestamp1>
    <otherdata> ... </otherdata>
</item1>
<item2 name='bar'>
    <timestamp1>2017-Jun-30 22:24:32</timestamp1>
    <otherdata> ... </otherdata>
    <timestamp2>2017-Jun-6 08:11:46</timestamp2>
</item2>

Re: Is it possible to set a conditional timestamp from indexed events?

woodcock — Fri, 30 Jun 2017 19:15:07 GMT

Like this:

TIME_PREFIX=(<timestamp1>(?!.*<timestamp2>))|(<timestamp2>)

Re: Is it possible to set a conditional timestamp from indexed events?

woodcock — Sun, 02 Jul 2017 02:53:13 GMT

Are these CDRs?