Help with TIME_FORMAT

[Newbie1]

Hi,

Trying to learn SPLUNK and I have troubles with timestamp,

My XML CODE is like this : <LOG><DATUM>26112022</DATUM><Vrijeme>224516</Vrijeme><CC>6894542532143100</CC><Iznos>46144.46</Iznos></LOG>

I got the date (DATUM) and now im trying to get the time, but my problem is I can't go to next line

props file looks like this

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)<\w{2,}>
TIME_PREFIX = <DATUM>
TIME_FORMAT = %d%m%Y</DATUM>\n<Vrijeme>%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 100

instead of "\n" i tried %n, [\r\n\s], and leave it blank, but nothing works, any tips?

[richgalloway]

Why are you trying to add a newline when the date and time appear to be on the same line in the example data?

Any characters in TIME_FORMAT that aren't preceded by '%' are taken literally so there's no way to specify a newline. If the date and time are on separate lines then use LINE_BREAKER or other props.conf settings to get them both on the same line.

TIME_FORMAT = %d%m%Y</DATUM><Vrijeme>%H%M%S