Getting Data In

How do I index one _time field from separated different time data?

goji
Path Finder

This is my data from with html tags. This is just single line.

03/<tr class="mtx" style="text-align:right;"><td style="white-space:nowrap"><div class="a_print"><a href="hourly_s1.php?prec_no=44&block_no=47662&year=1980&month=03&day=1&view=p1">1</a></div></td><td class="data_0_0">997.3</td><td class="data_0_0">1001.6</td><td class="data_0_0">13.5</td><td class="data_0_0">5.5</td><td class="data_0_0">1.5</td><td class="data_0_0">9.1</td><td class="data_0_0">14.2</td><td class="data_0_0">4.5</td><td class="data_0_0"> 59</td><td class="data_0_0"> 40</td><td class="data_0_0">6.5</td><td class="data_0_0">13.6</td><td class="data_0_0" style="text-align:center">–k–k¼</td><td class="data_0_0">24.6</td><td class="data_0_0" style="text-align:center">–k</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0" style="text-align:left">‰J</td><td class="data_0_0" style="text-align:left">~
‚È‚µ</td></tr>

The time of this data consists of three pieces of information: year=, month=, and date=.
So, I just use custom DATETIME_CONFIG to ingest the data but it doesn't work. This is my created .xml file.

<datetime>
  <define name="test" extract="year, month, day">
    <text><![CDATA[(?year\=(\d{4})&month\=(\d{2})&day\=(\d{1,2})]]></text>
  </define>

  <timePatterns>
    <use name="test"/>
  </timePatterns>
  <datePatterns>
    <use name="test"/>
  </datePatterns>
</datetime>

I think there is no grammatical error because there was no error at splunk restarted.
How do I index one _time field from three separated time data at index time?

Thank you,

0 Karma
1 Solution

sudosplunk
Motivator

Your datetime.xml looks good to me. Please make sure to put these configurations on both source(forwarders) and destination (indexers).

If nothing works, give this a try instead of datetime.xml

Append below to your props.conf

TIME_PREFIX = year\=
TIME_FORMAT = %y&month=%d&day=%d

View solution in original post

0 Karma

sudosplunk
Motivator

Your datetime.xml looks good to me. Please make sure to put these configurations on both source(forwarders) and destination (indexers).

If nothing works, give this a try instead of datetime.xml

Append below to your props.conf

TIME_PREFIX = year\=
TIME_FORMAT = %y&month=%d&day=%d
0 Karma

goji
Path Finder

nittala_surya,

This data was a bit old, so I could read it by increasing the value of MAX_DAYS_AGO.

Thank you!!!

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

Looks like your regex may have an issue.

Try
&year=(\d{4})&month=(\d{2})&day=(\d{1,2})

0 Karma

goji
Path Finder

I use "&" instead of "?" in front of year, but it doesn't work.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...