extract timestamp from xml

SplunkCSIT · ‎04-03-2014

i'm new to splunk, if i got the following xml file and want to extract the following date and time and set as an event timestamp, how to configure it and at forwarder or indexer end? thks

....
20/12/2013
14:13:23+08:00

somesoni2 · ‎04-03-2014

Try with following sourcetype definition (in props.conf)

[yoursourcetype]
BREAK_ONLY_BEFORE= *****mention your event start xml tag. e.g. \<data\>
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=%d/%m/%Y \</start_date\> \<start_time\> %H:%M:%S%z
TIME_PREFIX=\<start_date\>

extract timestamp from xml

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Technical Support Is Moving to Cisco Support Tools

Recap | Agentic Operations Start with Context: Build the Right Data Foundation

Recap | Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Join the Conversation

extract timestamp from xml

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Technical Support Is Moving to Cisco Support Tools

Recap | Agentic Operations Start with Context: Build the Right Data Foundation

Recap | Assisted, Augmented or Agentic? Choose Your Splunk Starting Point