Getting Data In
Highlighted

Is it possible to set a conditional timestamp from indexed events?

New Member

I have an XML file with "items" that are being indexed. The issue is that these "items" can possibly have two different timestamps. At the time of indexing I want to specify the timestamp conditional on which one is available. So every item at least has timestamp1
and only some have timestamp2 but if timestamp2 exists I want that to be the timestamp seen by splunk if not then I want timestamp1. The TIMEPREFIXES would be different but I cannot seem to find a way to make the TIMEPREFIX conditional.

Any ideas?

0 Karma
Highlighted

Re: Is it possible to set a conditional timestamp from indexed events?

Motivator

can you post some sample events.

0 Karma
Highlighted

Re: Is it possible to set a conditional timestamp from indexed events?

New Member

Example:

<item1 name='foo'>
    <timestamp1>2017-Jun-30 22:10:50</timestamp1>
    <otherdata> ... </otherdata>
</item1>
<item2 name='bar'>
    <timestamp1>2017-Jun-30 22:24:32</timestamp1>
    <otherdata> ... </otherdata>
    <timestamp2>2017-Jun-6 08:11:46</timestamp2>
</item2>
0 Karma
Highlighted

Re: Is it possible to set a conditional timestamp from indexed events?

Esteemed Legend

Like this:

TIME_PREFIX=(<timestamp1>(?!.*<timestamp2>))|(<timestamp2>)

View solution in original post

0 Karma
Highlighted

Re: Is it possible to set a conditional timestamp from indexed events?

Esteemed Legend

Are these CDRs?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.