Getting Data In

How do I edit my datetime.xml file for my custom date and time to be recognized in Splunk?

gagi76
New Member

Hi everyone,

Can someone tell me what I'm suppose to edit in my datetime.xml file for my custom date and time to be recognized in Splunk? Here is example of a log:
alt text

I have tried:
datetime.xml

<datetime>
<define name="Date" extract="year, month, day">
<text>\<DATE>(\d{4})(\d{2})(\d{2})</text>
</define>

<define name="Time" extract="hour, minute, second">
<text>\<TIME>(\d{2})(\d{2})(\d{2})</text>
</define>

<timePatterns>
<use name="Time"/>
</timePatterns>

<datePatterns>
<use name="Date"/>
</datePatterns>

</datetime>

props.conf

DATETIME_CONFIG = /etc/system/local/datetime.xml

I think I'm missing something here....

Thanks, cheers

0 Karma
1 Solution

woodcock
Esteemed Legend

Once you switch to datetime.xml, the other time configurations do not work.

DO NOT EDIT /etc/system/local/datetime.xml!

Create a new file inside of your app:

/etc/apps/YourApp/default/datetime.xml

In any case, you don't need a custom datetime.xml and I wouldn't do it that way because it is complicated and unnecessary.

In props.conf all you should need is this:

TIME_PREFIX = "<LOG><DATE>"
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 27

This, of course, presumes that you have event line-breaking working correctly.

View solution in original post

woodcock
Esteemed Legend

Once you switch to datetime.xml, the other time configurations do not work.

DO NOT EDIT /etc/system/local/datetime.xml!

Create a new file inside of your app:

/etc/apps/YourApp/default/datetime.xml

In any case, you don't need a custom datetime.xml and I wouldn't do it that way because it is complicated and unnecessary.

In props.conf all you should need is this:

TIME_PREFIX = "<LOG><DATE>"
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 27

This, of course, presumes that you have event line-breaking working correctly.

gagi76
New Member

i succeeded with :

TIME_PREFIX = DATE>
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S

Thanks for datetime.xml tips.

cheers

0 Karma

markusspitzli2
Explorer

Hey.

I have the same issue, but the date and time fields are on separate lines. How would you solve this?

...
<Date>20151130</Date>
<Time>082327</Time>
<Client>600</Client>
...

thanks
Markus

0 Karma

markusspitzli2
Explorer

I just got the answer by myself:

     TIME_FORMAT = %Y%m%d</DATE>%n<TIME>%H%M%S

gagi76
New Member

I changed it few times, and now looks like this and again splunk does not recognize date and time... any ideas?

First I did it with this props.conf:

DATETIME_CONFIG = C:\Program Files\Splunk\etc\system\local\datetime.xml

Second time with this props.conf:

DATETIME_CONFIG = C:\Program Files\Splunk\etc\system\local\datetime.xml
TIME_PREFIX = DATE\>
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S

And my datetime.xml looks like this now :

<?xml version="1.0" encoding="UTF-8"?>

<datetime>
<define name="_Date" extract="year, month, day">
    <text>\DATE>(\d{4})(\d{2})(\d{2})</text>
</define>

<define name="_Time" extract="hour, minute, second">
    <text>\TIME>(\d{2})(\d{2})(\d{2})</text>
</define>

<timePatterns>
    <use name="_Date"/>
    <use name="_Time"/>
</timePatterns>

<datePatterns>
    <use name="_Date"/>
    <use name="_Time"/>
</datePatterns>
</datetime>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...