Getting Data In

How to index an XML file with unix time format

New Member

I have XML files in my PC that I want to index them in Splunk, I need the inputs and the props.conf changed. I did everything but I am stock into line breaking events.
I have it in unix time format which is something like:


How to specify the time format !!?
and, I have no idea how to specify time format in my props.conf or transform.conf. if u have anything might help, please!!

0 Karma


Try these props

TIME_PREFIX = \<begin>
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...