Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: "Include only new or changed entries" option i...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Although I clicked "Include only new or changed entries" check box, all RSS feeds continue to be imported in Splunk. Can you help me to get only new or changed RSS data?
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The RSS feed (https://www.usom.gov.tr/rss/zararli-baglanti.rss) doesn't include a date field for the entries which is why the app isn't filtering them. The entries need to have a pubDate element to support automatic filtering.
You could handle this in search. For example, below is a search that deduplicates the entries and uses the time field to indicate when the item was first observed.
source="syndication://answers_239153" | stats earliest(_time) as earliest latest(_time) as last_seen by title | convert ctime(earliest) ctime(last_seen) | sort title
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The RSS feed (https://www.usom.gov.tr/rss/zararli-baglanti.rss) doesn't include a date field for the entries which is why the app isn't filtering them. The entries need to have a pubDate element to support automatic filtering.
You could handle this in search. For example, below is a search that deduplicates the entries and uses the time field to indicate when the item was first observed.
source="syndication://answers_239153" | stats earliest(_time) as earliest latest(_time) as last_seen by title | convert ctime(earliest) ctime(last_seen) | sort title
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you provide the URL if the feed is public? I can debug it from there. Otherwise, I can provide some guidance based on the logs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
https://www.usom.gov.tr/rss/zararli-baglanti.rss
I would be so glad.
Thanks,
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
