Getting Data In

How to index an XML file with unix time format

almotasim90
New Member

I have XML files in my PC that I want to index them in Splunk, I need the inputs and the props.conf changed. I did everything but I am stock into line breaking events.
I have it in unix time format which is something like:

<Date_range>
<begin>1586965192</begin>
<end>1586965199</end>
</Date_range>

How to specify the time format !!?
and, I have no idea how to specify time format in my props.conf or transform.conf. if u have anything might help, please!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try these props

[myxml]
TIME_FORMAT = %s
TIME_PREFIX = \<begin>
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...