datetime.xml

[VijaySrrie]

Hi Team,

I am asked to use datetime.xml for my logs. May I know how to use it? In props do I need to configure datetime.xml? or I need to point it to datetime.xml which splunk has?

if I need to point it how to write the configs?

Index=ps_main

sourcetype = psps

[richgalloway]

Splunk ships with a datetime.xml file that is used by default unless the relevant props.conf file contains DATETIME_CONFIG=CURRENT or DATETIME_CONFIG=NONE.  You can use your own datetime.xml file by putting DATETIME_CONFIG=/path/to/your/datetime.xml in the appropriate props.conf file.