"Include only new or changed entries" option is not working

[cogrunc]

Hello,

Although I clicked "Include only new or changed entries" check box, all RSS feeds continue to be imported in Splunk. Can you help me to get only new or changed RSS data?

Thanks,

[LukeMurphey · Accepted solution]

The RSS feed (https://www.usom.gov.tr/rss/zararli-baglanti.rss) doesn't include a date field for the entries which is why the app isn't filtering them. The entries need to have a pubDate element to support automatic filtering.

You could handle this in search. For example, below is a search that deduplicates the entries and uses the time field to indicate when the item was first observed.

source="syndication://answers_239153" | stats earliest(_time) as earliest latest(_time) as last_seen by title | convert ctime(earliest) ctime(last_seen) | sort title

[LukeMurphey]

Could you provide the URL if the feed is public? I can debug it from there. Otherwise, I can provide some guidance based on the logs.

[cogrunc]

https://www.usom.gov.tr/rss/zararli-baglanti.rss

I would be so glad.
Thanks,