Here is part of what my events that are in xml format look like:
Blockquote`` _id="1767282" _uuid="0D981036-9B9C-4841-969E-1DC5755039CC" _position="1767282" _address="http://xml.mydata_data.com4-ku6q/1767282">< date_action>2015-08-08T00:00:00< /date_action>< time_action>23:58:00< /time_action>
I am trying to work in props.conf to have Splunk identify the times and dates that that can be identified in the log file < date_action> & < time_action> (I INSERTED A SPACE AFTER EACH < so those labels appear in this post) . Should I extract those labels/identifiers instead? Or should I be using some sort of regex in Tranforms.conf + Props.conf?? I noticed that at the end of each date is a T00:00 which could be the culprit that is confusing the the time stamp I would like to configure/use 23:58:00 with the date. The log
any help would be appreciated, thanks!
... View more