Time and Date in two different places within my events

[jpelletier_splu]

Here is part of what my events that are in xml format look like:

Blockquote``_id="1767282" _uuid="0D981036-9B9C-4841-969E-1DC5755039CC" _position="1767282" _address="http://xml.mydata_data.com4-ku6q/1767282">< date_action>2015-08-08T00:00:00< /date_action>< time_action>23:58:00< /time_action>

I am trying to work in props.conf to have Splunk identify the times and dates that that can be identified in the log file < date_action> & < time_action> (I INSERTED A SPACE AFTER EACH < so those labels appear in this post) . Should I extract those labels/identifiers instead? Or should I be using some sort of regex in Tranforms.conf + Props.conf?? I noticed that at the end of each date is a T00:00 which could be the culprit that is confusing the the time stamp I would like to configure/use 23:58:00 with the date. The log

any help would be appreciated, thanks!

[somesoni2]

Add following timestamp related attributes to your props.conf for the sourcetype

[Yoursourcetype]
....Current entries.....
TIME_PREFIX=_address=\"
TIME_FORMAT=%Y-%m-%dT00:00:00%H:%M:%S

[jbjerke_splunk · Accepted solution]

Hi

For that format you should specify the following in props.conf

[ mysourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%dT00:00:00%H:%M:%S
TIME_PREFIX=_address="
MAX_TIMESTAMP_LOOKAHEAD=128

Let me know if it works. If it does, please mark the question as answered.

j