Is there a sequence Splunk uses (like alphabetical order) for datetime.xml ? As an example, time pattern "use_this-last" should be used only last:
<use name="use_this_first"/>
<use name="use_this-second"/>
<use name="use_this-last"/>
Yes there is. At the bottom on datetime.xml file, you'd find two Patterns blocks named timePatterns
and datePatterms
. In this you'd find element <use>
which defines the order in which the time/date extraction pattern is applied.
e.g. if the timepatterns
is like this
<timePatterns>
<use name="_time"/>
<use name="_hmtime"/>
...others..
</timePatterns>
Then there will be a <define name="_time"..
and <define name="_hmtime"..
defined in the datetime.xml file and they are applied in that order (first _time and then _hmtime is applied).
Yes there is. At the bottom on datetime.xml file, you'd find two Patterns blocks named timePatterns
and datePatterms
. In this you'd find element <use>
which defines the order in which the time/date extraction pattern is applied.
e.g. if the timepatterns
is like this
<timePatterns>
<use name="_time"/>
<use name="_hmtime"/>
...others..
</timePatterns>
Then there will be a <define name="_time"..
and <define name="_hmtime"..
defined in the datetime.xml file and they are applied in that order (first _time and then _hmtime is applied).