Getting Data In

How do I edit my datetime.xml file for my custom date and time to be recognized in Splunk?

gagi76
New Member

Hi everyone,

Can someone tell me what I'm suppose to edit in my datetime.xml file for my custom date and time to be recognized in Splunk? Here is example of a log:
alt text

I have tried:
datetime.xml

<datetime>
<define name="Date" extract="year, month, day">
<text>\<DATE>(\d{4})(\d{2})(\d{2})</text>
</define>

<define name="Time" extract="hour, minute, second">
<text>\<TIME>(\d{2})(\d{2})(\d{2})</text>
</define>

<timePatterns>
<use name="Time"/>
</timePatterns>

<datePatterns>
<use name="Date"/>
</datePatterns>

</datetime>

props.conf

DATETIME_CONFIG = /etc/system/local/datetime.xml

I think I'm missing something here....

Thanks, cheers

0 Karma
1 Solution

woodcock
Esteemed Legend

Once you switch to datetime.xml, the other time configurations do not work.

DO NOT EDIT /etc/system/local/datetime.xml!

Create a new file inside of your app:

/etc/apps/YourApp/default/datetime.xml

In any case, you don't need a custom datetime.xml and I wouldn't do it that way because it is complicated and unnecessary.

In props.conf all you should need is this:

TIME_PREFIX = "<LOG><DATE>"
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 27

This, of course, presumes that you have event line-breaking working correctly.

View solution in original post

woodcock
Esteemed Legend

Once you switch to datetime.xml, the other time configurations do not work.

DO NOT EDIT /etc/system/local/datetime.xml!

Create a new file inside of your app:

/etc/apps/YourApp/default/datetime.xml

In any case, you don't need a custom datetime.xml and I wouldn't do it that way because it is complicated and unnecessary.

In props.conf all you should need is this:

TIME_PREFIX = "<LOG><DATE>"
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 27

This, of course, presumes that you have event line-breaking working correctly.

gagi76
New Member

i succeeded with :

TIME_PREFIX = DATE>
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S

Thanks for datetime.xml tips.

cheers

0 Karma

markusspitzli2
Explorer

Hey.

I have the same issue, but the date and time fields are on separate lines. How would you solve this?

...
<Date>20151130</Date>
<Time>082327</Time>
<Client>600</Client>
...

thanks
Markus

0 Karma

markusspitzli2
Explorer

I just got the answer by myself:

     TIME_FORMAT = %Y%m%d</DATE>%n<TIME>%H%M%S

gagi76
New Member

I changed it few times, and now looks like this and again splunk does not recognize date and time... any ideas?

First I did it with this props.conf:

DATETIME_CONFIG = C:\Program Files\Splunk\etc\system\local\datetime.xml

Second time with this props.conf:

DATETIME_CONFIG = C:\Program Files\Splunk\etc\system\local\datetime.xml
TIME_PREFIX = DATE\>
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S

And my datetime.xml looks like this now :

<?xml version="1.0" encoding="UTF-8"?>

<datetime>
<define name="_Date" extract="year, month, day">
    <text>\DATE>(\d{4})(\d{2})(\d{2})</text>
</define>

<define name="_Time" extract="hour, minute, second">
    <text>\TIME>(\d{2})(\d{2})(\d{2})</text>
</define>

<timePatterns>
    <use name="_Date"/>
    <use name="_Time"/>
</timePatterns>

<datePatterns>
    <use name="_Date"/>
    <use name="_Time"/>
</datePatterns>
</datetime>
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...