Getting Data In
Highlighted

Is it possible to set a conditional timestamp from indexed events?

New Member

I have an XML file with "items" that are being indexed. The issue is that these "items" can possibly have two different timestamps. At the time of indexing I want to specify the timestamp conditional on which one is available. So every item at least has timestamp1
and only some have timestamp2 but if timestamp2 exists I want that to be the timestamp seen by splunk if not then I want timestamp1. The TIMEPREFIXES would be different but I cannot seem to find a way to make the TIMEPREFIX conditional.

Any ideas?

0 Karma
Highlighted

Re: Is it possible to set a conditional timestamp from indexed events?

Motivator

can you post some sample events.

0 Karma
Highlighted

Re: Is it possible to set a conditional timestamp from indexed events?

New Member

Example:

<item1 name='foo'>
    <timestamp1>2017-Jun-30 22:10:50</timestamp1>
    <otherdata> ... </otherdata>
</item1>
<item2 name='bar'>
    <timestamp1>2017-Jun-30 22:24:32</timestamp1>
    <otherdata> ... </otherdata>
    <timestamp2>2017-Jun-6 08:11:46</timestamp2>
</item2>
0 Karma
Highlighted

Re: Is it possible to set a conditional timestamp from indexed events?

Esteemed Legend

Like this:

TIME_PREFIX=(<timestamp1>(?!.*<timestamp2>))|(<timestamp2>)

View solution in original post

0 Karma
Highlighted

Re: Is it possible to set a conditional timestamp from indexed events?

Esteemed Legend

Are these CDRs?

0 Karma