Getting Data In

DateTime extraction from an XML file - Why are dates not in sequence?

SpockGin
Explorer

I am doing some lab work and am struggling with a date/time extraction for an XML file.

There is *some sucess as I can get the date out of the data (between two <ActionDate> tags) though when I look at the ordering of the data, it is out of sequence.

I am doing this on a Stand Alone instance via the front end. I am wondering if something is off in my config, can any one advise?

 

 

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\s*<Interceptor>
BREAK_ONLY_BEFORE_DATE=null
NO_BINARY_CHECK=true
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=15
TIME_FORMAT=%F
TIME_PREFIX=<ActionDate>
kv_mode=xml
pulldown_type=true
TZ=America/New_York

 

 

 

Here is a screenshot too with how it is showing. Note the dates are not in sequence. What could be causing this?

 

SpockGin_1-1683715075281.png

 

 

Thanks

 

Labels (1)
0 Karma
1 Solution

SpockGin
Explorer

Further to this, I can confirm this works in the app.

The dates being out of sequence is just when doing the front end extractions (as it is not yet indexed). In the app it works properly.

 

Thanks

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SpockGin,

add "INDEXED_EXTRACTIONS = XML" to your props.conf, so you can define the field to use as timestamp.

Ciao.

Giuseppe

SpockGin
Explorer

Further to this, I can confirm this works in the app.

The dates being out of sequence is just when doing the front end extractions (as it is not yet indexed). In the app it works properly.

 

Thanks

0 Karma

SpockGin
Explorer

Hi @gcusello 

 

Thanks for your reply, I have to check,  as I have looked at that though the docs do not specify XML as an option.

https://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata

INDEXED_EXTRACTIONS = <CSV|W3C|TSV|PSV|JSON|HEC>

 

Thanks

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SpockGin,

sorry: xml isn't in structured indexed!

anyway the TIMR_PREFIX and TIME_FORMAT are wrong, please try this:

TIME_FORMAT=%Y-%m-%d
TIME_PREFIX=\<ActionDate\>

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...