All Apps and Add-ons

"Include only new or changed entries" option is not working

cogrunc
New Member

Hello,

Although I clicked "Include only new or changed entries" check box, all RSS feeds continue to be imported in Splunk. Can you help me to get only new or changed RSS data?

Thanks,

0 Karma
1 Solution

LukeMurphey
Champion

The RSS feed (https://www.usom.gov.tr/rss/zararli-baglanti.rss) doesn't include a date field for the entries which is why the app isn't filtering them. The entries need to have a pubDate element to support automatic filtering.

You could handle this in search. For example, below is a search that deduplicates the entries and uses the time field to indicate when the item was first observed.

source="syndication://answers_239153" | stats earliest(_time) as earliest latest(_time) as last_seen by title | convert ctime(earliest) ctime(last_seen) | sort title

View solution in original post

0 Karma

LukeMurphey
Champion

The RSS feed (https://www.usom.gov.tr/rss/zararli-baglanti.rss) doesn't include a date field for the entries which is why the app isn't filtering them. The entries need to have a pubDate element to support automatic filtering.

You could handle this in search. For example, below is a search that deduplicates the entries and uses the time field to indicate when the item was first observed.

source="syndication://answers_239153" | stats earliest(_time) as earliest latest(_time) as last_seen by title | convert ctime(earliest) ctime(last_seen) | sort title

View solution in original post

0 Karma

LukeMurphey
Champion

Could you provide the URL if the feed is public? I can debug it from there. Otherwise, I can provide some guidance based on the logs.

0 Karma

cogrunc
New Member
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.