Is it possible to set a conditional timestamp from indexed events?

[amanno]

I have an XML file with "items" that are being indexed. The issue is that these "items" can possibly have two different timestamps. At the time of indexing I want to specify the timestamp conditional on which one is available. So every item at least has timestamp1
and only some have timestamp2 but if timestamp2 exists I want that to be the timestamp seen by splunk if not then I want timestamp1. The TIME_PREFIXES would be different but I cannot seem to find a way to make the TIME_PREFIX conditional.

Any ideas?

[woodcock]

Are these CDRs?

[woodcock · Accepted solution]

Like this:

TIME_PREFIX=(<timestamp1>(?!.*<timestamp2>))|(<timestamp2>)

[amanno]

Example:

<item1 name='foo'>
    <timestamp1>2017-Jun-30 22:10:50</timestamp1>
    <otherdata> ... </otherdata>
</item1>
<item2 name='bar'>
    <timestamp1>2017-Jun-30 22:24:32</timestamp1>
    <otherdata> ... </otherdata>
    <timestamp2>2017-Jun-6 08:11:46</timestamp2>
</item2>

[sbbadri]

can you post some sample events.