Getting Data In

How do I index one _time field from separated different time data?

goji
Explorer

This is my data from with html tags. This is just single line.

03/<tr class="mtx" style="text-align:right;"><td style="white-space:nowrap"><div class="a_print"><a href="hourly_s1.php?prec_no=44&block_no=47662&year=1980&month=03&day=1&view=p1">1</a></div></td><td class="data_0_0">997.3</td><td class="data_0_0">1001.6</td><td class="data_0_0">13.5</td><td class="data_0_0">5.5</td><td class="data_0_0">1.5</td><td class="data_0_0">9.1</td><td class="data_0_0">14.2</td><td class="data_0_0">4.5</td><td class="data_0_0"> 59</td><td class="data_0_0"> 40</td><td class="data_0_0">6.5</td><td class="data_0_0">13.6</td><td class="data_0_0" style="text-align:center">–k–k¼</td><td class="data_0_0">24.6</td><td class="data_0_0" style="text-align:center">–k</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0" style="text-align:left">‰J</td><td class="data_0_0" style="text-align:left">~
‚È‚µ</td></tr>

The time of this data consists of three pieces of information: year=, month=, and date=.
So, I just use custom DATETIME_CONFIG to ingest the data but it doesn't work. This is my created .xml file.

<datetime>
  <define name="test" extract="year, month, day">
    <text><![CDATA[(?year\=(\d{4})&month\=(\d{2})&day\=(\d{1,2})]]></text>
  </define>

  <timePatterns>
    <use name="test"/>
  </timePatterns>
  <datePatterns>
    <use name="test"/>
  </datePatterns>
</datetime>

I think there is no grammatical error because there was no error at splunk restarted.
How do I index one _time field from three separated time data at index time?

Thank you,

0 Karma
1 Solution

sudosplunk
Motivator

Your datetime.xml looks good to me. Please make sure to put these configurations on both source(forwarders) and destination (indexers).

If nothing works, give this a try instead of datetime.xml

Append below to your props.conf

TIME_PREFIX = year\=
TIME_FORMAT = %y&month=%d&day=%d

View solution in original post

0 Karma

sudosplunk
Motivator

Your datetime.xml looks good to me. Please make sure to put these configurations on both source(forwarders) and destination (indexers).

If nothing works, give this a try instead of datetime.xml

Append below to your props.conf

TIME_PREFIX = year\=
TIME_FORMAT = %y&month=%d&day=%d
0 Karma

goji
Explorer

nittala_surya,

This data was a bit old, so I could read it by increasing the value of MAX_DAYS_AGO.

Thank you!!!

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

Looks like your regex may have an issue.

Try
&year=(\d{4})&month=(\d{2})&day=(\d{1,2})

0 Karma

goji
Explorer

I use "&" instead of "?" in front of year, but it doesn't work.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...