https://community.splunk.com/t5/Splunk-Enterprise/datetime-xml/m-p/513514#M2995 <P>Hi Team,</P><P>I am asked to use datetime.xml for my logs. May I know how to use it? In props do I need to configure datetime.xml? or I need to point it to datetime.xml which splunk has?</P><P>if I need to point it how to write the configs?</P><P>Index=ps_main</P><P>sourcetype = psps</P> Tue, 11 Aug 2020 07:52:13 GMT VijaySrrie 2020-08-11T07:52:13Z https://community.splunk.com/t5/Splunk-Enterprise/datetime-xml/m-p/513514#M2995 <P>Hi Team,</P><P>I am asked to use datetime.xml for my logs. May I know how to use it? In props do I need to configure datetime.xml? or I need to point it to datetime.xml which splunk has?</P><P>if I need to point it how to write the configs?</P><P>Index=ps_main</P><P>sourcetype = psps</P> Tue, 11 Aug 2020 07:52:13 GMT https://community.splunk.com/t5/Splunk-Enterprise/datetime-xml/m-p/513514#M2995 VijaySrrie 2020-08-11T07:52:13Z https://community.splunk.com/t5/Splunk-Enterprise/datetime-xml/m-p/513571#M2998 <P>Splunk ships with a datetime.xml file that is used by default unless the relevant props.conf file contains <FONT face="courier new,courier">DATETIME_CONFIG=CURRENT</FONT> or <FONT face="courier new,courier">DATETIME_CONFIG=NONE</FONT>.&nbsp; You can use your own datetime.xml file by putting <FONT face="courier new,courier">DATETIME_CONFIG=/path/to/your/datetime.xml</FONT> in the appropriate props.conf file.</P> Tue, 11 Aug 2020 13:12:40 GMT https://community.splunk.com/t5/Splunk-Enterprise/datetime-xml/m-p/513571#M2998 richgalloway 2020-08-11T13:12:40Z