REGEX help with ingesting XML file. Timestamp not working correctly

[joesrepsol]

Looking to extract the "2017-06-23 15:48:56.218" from the 2nd line in the log and use it for the timestamp when ingesting this xml log into Splunk. Today Splunk is picking up the wrong timestamp for the timestamp recognition, which causes problems.

Thinking that I need to define some REGEX in a props.conf/transforms.conf file but missing the REGEX experience to pull this out.

Help?

<auditEvent encrypted="n" signed="n">
    <localTime>2017-06-23 15:48:56.218 -0700</localTime>
    <time>2017-06-23 22:48:56.218</time>
    <utc>2017-06-23 22:48:56.218</utc>
    <sessionId>25</sessionId>
    <msg>
        <msgID>AUD0117E</msgID>
        <msgText>SessionId: 25 - Login attempt to CM by intruder through local store Failed with an operator role of UNKNOWN ROLE</msgText>
        <condCode>8</condCode>
    </msg>
</auditEvent>

using Splunk Enterprise 6.5.0 (Linux)

[joesrepsol]

Also noticed that Splunk is not automatically figuring out which breaks to use for the entire event... WHOA. In this case, it's XML and I need to also figure out how to tell splunk that each event starts with:

<auditEvent encrypted="n" signed="n">

and ends with:

</auditEvent>

[joesrepsol]

Clarification...

Looking to pull the date/time stamp between "" and "-0700"