Parsing XML having seperate date and time tags

[vganjare]

HI,

I am having following xml log which has two seperate tags for Date and time. I want to use Date + Time together as timestamp.

<data>
    <detail>
        <date>01-17-2015</date>
        <time>10:35:235</time>
        <country>US</country>
    </detail>
    <detail>
        <date>01-18-2015</date>
        <time>12:21:754</time>
        <country>US</country>
    </detail>
</data>

Here, I want use &ltdate&gt + &lttime&gt as TIME_PREFIX. What value of TIME_PREFIX should be set in props.conf?

Thanks.

[woodcock]

Use datetime.xml; to use the first date/time pair, do this:

Inside /opt/splunk/etc/apps/myApp/default/props.conf do this:

[mySourceType]
DATETIME_CONFIG = /etc/apps/myApp/default/datetime.xml

Inside /opt/splunk/etc/apps/myApp/default/datetime.xml do this:

<datetime>
<define name="_myXMLdate" extract="month, day, year">
<text><![CDATA[<date>(\d(2)-\d(2)-(\d{4})<\date>]]></text>
</define>
<define name="_myXMLtime" extract="hour, minute">
<text><![CDATA[<time>(\d{2}):(\d{2}):\d{3}</time>]]></text>
</define>
<timePatterns>
<use name="_myXMLtime"/>
</timePatterns>
<datePatterns>
<use name="_myXMLdate"/>
</datePatterns>
</datetime>

[vganjare]

Any way to solve this case?

Thanks!!

[tom_frotscher]

Hi,
i can not lead you to a complete answer to this, but maybe i can give you an idea or something to search for. It looks like you need a custom datetime.xml for your sourcetype to solve this problem. The bad thing is, that there is only poorly documentation for the datetime.xml 😞

Maybe some examples can help:

http://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem

http://blogs.splunk.com/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename/