Getting Data In

How do I index one _time field from separated different time data?

goji
Explorer

This is my data from with html tags. This is just single line.

03/<tr class="mtx" style="text-align:right;"><td style="white-space:nowrap"><div class="a_print"><a href="hourly_s1.php?prec_no=44&block_no=47662&year=1980&month=03&day=1&view=p1">1</a></div></td><td class="data_0_0">997.3</td><td class="data_0_0">1001.6</td><td class="data_0_0">13.5</td><td class="data_0_0">5.5</td><td class="data_0_0">1.5</td><td class="data_0_0">9.1</td><td class="data_0_0">14.2</td><td class="data_0_0">4.5</td><td class="data_0_0"> 59</td><td class="data_0_0"> 40</td><td class="data_0_0">6.5</td><td class="data_0_0">13.6</td><td class="data_0_0" style="text-align:center">–k–k¼</td><td class="data_0_0">24.6</td><td class="data_0_0" style="text-align:center">–k</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0" style="text-align:left">‰J</td><td class="data_0_0" style="text-align:left">~
‚È‚µ</td></tr>

The time of this data consists of three pieces of information: year=, month=, and date=.
So, I just use custom DATETIME_CONFIG to ingest the data but it doesn't work. This is my created .xml file.

<datetime>
  <define name="test" extract="year, month, day">
    <text><![CDATA[(?year\=(\d{4})&month\=(\d{2})&day\=(\d{1,2})]]></text>
  </define>

  <timePatterns>
    <use name="test"/>
  </timePatterns>
  <datePatterns>
    <use name="test"/>
  </datePatterns>
</datetime>

I think there is no grammatical error because there was no error at splunk restarted.
How do I index one _time field from three separated time data at index time?

Thank you,

0 Karma
1 Solution

sudosplunk
Motivator

Your datetime.xml looks good to me. Please make sure to put these configurations on both source(forwarders) and destination (indexers).

If nothing works, give this a try instead of datetime.xml

Append below to your props.conf

TIME_PREFIX = year\=
TIME_FORMAT = %y&month=%d&day=%d

View solution in original post

0 Karma

sudosplunk
Motivator

Your datetime.xml looks good to me. Please make sure to put these configurations on both source(forwarders) and destination (indexers).

If nothing works, give this a try instead of datetime.xml

Append below to your props.conf

TIME_PREFIX = year\=
TIME_FORMAT = %y&month=%d&day=%d
0 Karma

goji
Explorer

nittala_surya,

This data was a bit old, so I could read it by increasing the value of MAX_DAYS_AGO.

Thank you!!!

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

Looks like your regex may have an issue.

Try
&year=(\d{4})&month=(\d{2})&day=(\d{1,2})

0 Karma

goji
Explorer

I use "&" instead of "?" in front of year, but it doesn't work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...