Splunk Search

How to extract timestamp from XML

yurykiselev
Path Finder

Hi!
Find same issue but Unfortunatelly doesn't work for me.

<?xml version="1.0" encoding="utf-8" ?>
<DynavisionXML version="1.1">
<name>Fname, Sname</name>
<email></email>
<ID></ID>
<startdatetime>
<year>2016</year>
<month>3</month>
<day>4</day>
<hour>4</hour>
<minute>54</minute>
<second>55</second>
</startdatetime>
...
</DynavisionXML>

Timestamp specification:

MAX_TIMESTAMP_LOOKAHEAD=105
TIME_PREFIX=\<year\>
TIME_FORMAT=%Y\<\/year\>[\r\n\s]+\<month\>%m\<\/month\>[\r\n\s]+\<day\>%d\<\/day\>[\r\n\s]+\<hour\>%H\<\/hour\>[\r\n\s]+\<minute\>%M\<\/minute\>[\r\n\s]+\<second\>%S\<\/second\>

But Splunk returns an error:

Could not use strptime to parse timestamp from
'2016\r\n3\r\n4\r\n4\r\n54\r\n55'

Thank you!

0 Karma
1 Solution

yurykiselev
Path Finder

Found solution:

TIME_PREFIX=<year>
TIME_FORMAT=%Y</year>%n<month>%m</month>%n<day>%d</day>%n<hour>%H</hour>%n<minute>%M</minute>%n<second>%S</second>

Problem was
1) that for normal timestamp recognition strptime() (func that works behind it) needs at minimum year+month+day for this.
2) "%n" should be used for new line instead of "[\r\n]+"

View solution in original post

yurykiselev
Path Finder

Found solution:

TIME_PREFIX=<year>
TIME_FORMAT=%Y</year>%n<month>%m</month>%n<day>%d</day>%n<hour>%H</hour>%n<minute>%M</minute>%n<second>%S</second>

Problem was
1) that for normal timestamp recognition strptime() (func that works behind it) needs at minimum year+month+day for this.
2) "%n" should be used for new line instead of "[\r\n]+"

michael_sleep
Communicator

If you use a custom datetime config XML it will probably work... this may do what you're looking for:

<datetime>
<define name="_xmldateformat" extract="year, month, day, hour, minute, second">
     <text>\<year\>(\d+)\<\/year\>[\s\n\r]+\<month\>(\d+)\<\/month\>[\s\n\r]+\<day\>(\d+)\<\/day\>[\s\n\r]+\<hour\>(\d)\<\/hour\>[\s\n\r]+\<minute\>(\d+)\<\/minute\>[\s\n\r]+\<second\>(\d+)\<\/second\></text>
</define>
<timePatterns>
     <use name="_xmldateformat"/>
</timePatterns>
<datePatterns>
     <use name="_xmldateformat"/>
</datePatterns>
</datetime>
0 Karma

woodcock
Esteemed Legend

If your timestamp is spread across multiple lines, your only option is a custom datetime.xml:

https://www.splunk.com/blog/2014/04/23/its-that-time-again.html

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...