Dashboards & Visualizations

Time format XML Multiple lines

rmanrique
Path Finder

I don't know what to specify in the time_format so that it captures the date (<ActionDate>) and time (<ActionTime>), whose data is separated into separate lines.

XML file

<Interceptor>
		<AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords>
		<Outcome>Interdiction</Outcome>
		<Infiltrators>23</Infiltrators>
		<Enforcer>Ironwood</Enforcer>
		<ActionDate>2013-04-24</ActionDate>
		<ActionTime>00:07:00</ActionTime>
		<RecordNotes></RecordNotes>
		<NumEscaped>0</NumEscaped>
		<LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords>
		<AttackVessel>Rustic</AttackVessel>
	</Interceptor>

This is the configuration that I have in my props.conf

BREAK_ONLY_BEFORE_DATE = 
DATETIME_CONFIG = 
LINE_BREAKER = </Interceptor>([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = 
disabled = false
pulldown_type = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = <ActionDate>

 The TIME_FORMAT part is what I have to correct. I tried to put this in, but it didn't work.

TIME_FORMAT= %Y-%m-%d</ActionDate>%n<ActionTime>%H:%M:%S

 Any ideas

Labels (1)
0 Karma
1 Solution

dmarling
Builder

If you do have data from 2013 you can add MAX_DAYS_AGO to make it work:

crossline datetime maxdays.png

If this comment/answer was helpful, please up vote it. Thank you.

View solution in original post

dmarling
Builder

Based on a previous answer: https://community.splunk.com/t5/Getting-Data-In/How-to-set-date-time-stamps-across-two-lines-in-xml-... it appears as if you can ignore the line break so it would be something like this:

TIME_FORMAT= %Y-%m-%d</ActionDate><ActionTime>%H:%M:%S
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

dmarling
Builder

I played with your example and adjusted the date of it so I wouldn't have to mess with max lookbehind:

	<Interceptor>
		<AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords>
		<Outcome>Interdiction</Outcome>
		<Infiltrators>23</Infiltrators>
		<Enforcer>Ironwood</Enforcer>
		<ActionDate>2020-05-24</ActionDate>
		<ActionTime>00:07:00</ActionTime>
		<RecordNotes></RecordNotes>
		<NumEscaped>0</NumEscaped>
		<LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords>
		<AttackVessel>Rustic</AttackVessel>
	</Interceptor>

I got the date/time to pull correctly with the below parameters:

TIME_PREFIX = <ActionDate>
TIME_FORMAT = %Y-%m-%d</ActionDate>%n		<ActionTime>%H:%M:%S

crossline datetime.png

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

dmarling
Builder

If you do have data from 2013 you can add MAX_DAYS_AGO to make it work:

crossline datetime maxdays.png

If this comment/answer was helpful, please up vote it. Thank you.

rmanrique
Path Finder

Thank you!

I finally used MAX_DAYS_AGO to make it work. 

BREAK_ONLY_BEFORE_DATE = 
DATETIME_CONFIG = 
LINE_BREAKER = </Interceptor>([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = 
disabled = false
pulldown_type = true
TIME_FORMAT = %Y-%m-%d</ActionDate>%n<ActionTime>%H:%M:%S
TIME_PREFIX = <ActionDate>
MAX_DAYS_AGO = 3650
0 Karma

rmanrique
Path Finder

I got this error message.

error splunk.png

Is the time_prefix I used okay?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...