i'm new to splunk, if i got the following xml file and want to extract the following date and time and set as an event timestamp, how to configure it and at forwarder or indexer end? thks
.... 20/12/2013 14:13:23+08:00
Try with following sourcetype definition (in props.conf)
[yoursourcetype] BREAK_ONLY_BEFORE= *****mention your event start xml tag. e.g. \<data\> NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true TIME_FORMAT=%d/%m/%Y \</start_date\> \<start_time\> %H:%M:%S%z TIME_PREFIX=\<start_date\>
