Does Splunk use alphabetical order for datetime.xml parsing?

anoopambli — Mon, 16 Jul 2018 17:21:54 GMT

Is there a sequence Splunk uses (like alphabetical order) for datetime.xml ? As an example, time pattern "use_this-last" should be used only last:

   <use name="use_this_first"/>

   <use name="use_this-second"/> 

   <use name="use_this-last"/>

Re: Does Splunk use alphabetical order for datetime.xml parsing?

somesoni2 — Mon, 16 Jul 2018 19:36:42 GMT

Yes there is. At the bottom on datetime.xml file, you'd find two Patterns blocks named timePatterns and datePatterms. In this you'd find element <use> which defines the order in which the time/date extraction pattern is applied.

e.g. if the timepatterns is like this

<timePatterns>
   <use name="_time"/>
   <use name="_hmtime"/>
...others..
</timePatterns>

Then there will be a <define name="_time".. and <define name="_hmtime".. defined in the datetime.xml file and they are applied in that order (first _time and then _hmtime is applied).

topic Re: Does Splunk use alphabetical order for datetime.xml parsing? in Getting Data In

Does Splunk use alphabetical order for datetime.xml parsing?

Re: Does Splunk use alphabetical order for datetime.xml parsing?