topic Re: How to extract timestamp from XML in Splunk Search

How to extract timestamp from XML

yurykiselev — Tue, 30 May 2017 10:14:11 GMT

Hi!
Find same issue but Unfortunatelly doesn't work for me.

<?xml version="1.0" encoding="utf-8" ?>
<DynavisionXML version="1.1">
<name>Fname, Sname</name>
<email></email>
<ID></ID>
<startdatetime>
<year>2016</year>
<month>3</month>
<day>4</day>
<hour>4</hour>
<minute>54</minute>
<second>55</second>
</startdatetime>
...
</DynavisionXML>

Timestamp specification:

MAX_TIMESTAMP_LOOKAHEAD=105
TIME_PREFIX=\<year\>
TIME_FORMAT=%Y\<\/year\>[\r\n\s]+\<month\>%m\<\/month\>[\r\n\s]+\<day\>%d\<\/day\>[\r\n\s]+\<hour\>%H\<\/hour\>[\r\n\s]+\<minute\>%M\<\/minute\>[\r\n\s]+\<second\>%S\<\/second\>

But Splunk returns an error:

Could not use strptime to parse timestamp from
'2016\r\n3\r\n4\r\n4\r\n54\r\n55'

Thank you!

Re: How to extract timestamp from XML

woodcock — Tue, 30 May 2017 15:20:21 GMT

If your timestamp is spread across multiple lines, your only option is a custom datetime.xml:

https://www.splunk.com/blog/2014/04/23/its-that-time-again.html

Re: How to extract timestamp from XML

michael_sleep — Fri, 02 Jun 2017 15:15:12 GMT

If you use a custom datetime config XML it will probably work... this may do what you're looking for:

<datetime>
<define name="_xmldateformat" extract="year, month, day, hour, minute, second">
     <text>\<year\>(\d+)\<\/year\>[\s\n\r]+\<month\>(\d+)\<\/month\>[\s\n\r]+\<day\>(\d+)\<\/day\>[\s\n\r]+\<hour\>(\d)\<\/hour\>[\s\n\r]+\<minute\>(\d+)\<\/minute\>[\s\n\r]+\<second\>(\d+)\<\/second\></text>
</define>
<timePatterns>
     <use name="_xmldateformat"/>
</timePatterns>
<datePatterns>
     <use name="_xmldateformat"/>
</datePatterns>
</datetime>

Re: How to extract timestamp from XML

yurykiselev — Thu, 02 Nov 2017 11:48:33 GMT

Found solution:

TIME_PREFIX=<year>
TIME_FORMAT=%Y</year>%n<month>%m</month>%n<day>%d</day>%n<hour>%H</hour>%n<minute>%M</minute>%n<second>%S</second>

Problem was
1) that for normal timestamp recognition strptime() (func that works behind it) needs at minimum year+month+day for this.
2) "%n" should be used for new line instead of "[\r\n]+"