I have XML files in my PC that I want to index them in Splunk, I need the inputs and the props.conf changed. I did everything but I am stock into line breaking events.
I have it in unix time format which is something like:
How to specify the time format !!?
and, I have no idea how to specify time format in my props.conf or transform.conf. if u have anything might help, please!!
Try these props
TIME_FORMAT = %s
TIME_PREFIX = \<begin>