i'm new to splunk, if i got the following xml file and want to extract the following date and time and set as an event timestamp, how to configure it and at forwarder or indexer end? thks
....
Try with following sourcetype definition (in props.conf)
[yoursourcetype]
BREAK_ONLY_BEFORE= *****mention your event start xml tag. e.g. \<data\>
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%d/%m/%Y \</start_date\> \<start_time\> %H:%M:%S%z
TIME_PREFIX=\<start_date\>