https://community.splunk.com/t5/Getting-Data-In/extract-timestamp-from-xml/m-p/118867#M24677 <P>Try with following sourcetype definition (in props.conf)</P> <PRE><CODE>[yoursourcetype] BREAK_ONLY_BEFORE= *****mention your event start xml tag. e.g. \&lt;data\&gt; NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true TIME_FORMAT=%d/%m/%Y \&lt;/start_date\&gt; \&lt;start_time\&gt; %H:%M:%S%z TIME_PREFIX=\&lt;start_date\&gt; </CODE></PRE> Thu, 03 Apr 2014 15:04:12 GMT somesoni2 2014-04-03T15:04:12Z https://community.splunk.com/t5/Getting-Data-In/extract-timestamp-from-xml/m-p/118866#M24676 <P>i'm new to splunk, if i got the following xml file and want to extract the following date and time and set as an event timestamp, how to configure it and at forwarder or indexer end? thks</P> <P>....<BR /> <START_DATE> 20/12/2013 </START_DATE><BR /> <START_TIME> 14:13:23+08:00 </START_TIME></P> Thu, 03 Apr 2014 14:53:49 GMT https://community.splunk.com/t5/Getting-Data-In/extract-timestamp-from-xml/m-p/118866#M24676 SplunkCSIT 2014-04-03T14:53:49Z https://community.splunk.com/t5/Getting-Data-In/extract-timestamp-from-xml/m-p/118867#M24677 <P>Try with following sourcetype definition (in props.conf)</P> <PRE><CODE>[yoursourcetype] BREAK_ONLY_BEFORE= *****mention your event start xml tag. e.g. \&lt;data\&gt; NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true TIME_FORMAT=%d/%m/%Y \&lt;/start_date\&gt; \&lt;start_time\&gt; %H:%M:%S%z TIME_PREFIX=\&lt;start_date\&gt; </CODE></PRE> Thu, 03 Apr 2014 15:04:12 GMT https://community.splunk.com/t5/Getting-Data-In/extract-timestamp-from-xml/m-p/118867#M24677 somesoni2 2014-04-03T15:04:12Z