DateTime extraction from an XML file - Why are dates not in sequence?

[SpockGin]

I am doing some lab work and am struggling with a date/time extraction for an XML file.

There is *some sucess as I can get the date out of the data (between two <ActionDate> tags) though when I look at the ordering of the data, it is out of sequence.

I am doing this on a Stand Alone instance via the front end. I am wondering if something is off in my config, can any one advise?

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\s*<Interceptor>
BREAK_ONLY_BEFORE_DATE=null
NO_BINARY_CHECK=true
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=15
TIME_FORMAT=%F
TIME_PREFIX=<ActionDate>
kv_mode=xml
pulldown_type=true
TZ=America/New_York

Here is a screenshot too with how it is showing. Note the dates are not in sequence. What could be causing this?

SpockGin_1-1683715075281.png

Thanks

[gcusello]

Hi @SpockGin,

add "INDEXED_EXTRACTIONS = XML" to your props.conf, so you can define the field to use as timestamp.

Ciao.

Giuseppe

[SpockGin · Accepted solution]

Further to this, I can confirm this works in the app.

The dates being out of sequence is just when doing the front end extractions (as it is not yet indexed). In the app it works properly.

Thanks

[SpockGin]

Hi @gcusello 

Thanks for your reply, I have to check,  as I have looked at that though the docs do not specify XML as an option.

https://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata

INDEXED_EXTRACTIONS = <CSV|W3C|TSV|PSV|JSON|HEC>

Thanks

[gcusello]

Hi @SpockGin,

sorry: xml isn't in structured indexed!

anyway the TIMR_PREFIX and TIME_FORMAT are wrong, please try this:

TIME_FORMAT=%Y-%m-%d
TIME_PREFIX=\<ActionDate\>

Ciao.

Giuseppe