Best way to add start time from external time to time field in searches

[seam0n]

I've got the start time for my events in a external xml-file.
Is there a easy way to access this information in a search?
I want to add this start time to my time field in searches.
My events are individual elements from xml-files, which were
parsed as defined in my props.conf

File containing start time
<?xml version="1.0" ?>
<table name="Result">
<row id="0">
<TimeZone>-3600</TimeZone>
<StartTime>1414656604</StartTime>
<ResultEndTime>1414670180</ResultEndTime>
</row>
</table>

My props.conf
[<stanza>]
DATETIME_CONFIG = CURRENT
LINE_BREAKER = (\<\?.+?\?\>)|(\<table name\=\".+?\"\>)|(\<\/table\>)|(\<row.*?\>)|(\<\/row\>)
KV_MODE = xml
sourcetype = xml
TRUNCATE = 0

[seam0n]

This was not solved by configuring settings in Splunk, instead I had to reformat the xml files.

[lguinn2]

Why are you using the current datetime to index the events instead of the start time in the file?

But to answer your question, you should be able to access the StartTime quite easily in your search. There should be a field named StartTime. You could do StartTime > 1414656604 for example.

What exactly do you want to do with the start time?

[seam0n]

Thank you Inguinn, you are right, I should extract datetime in props. I really don't know how to though, I understand that I should define a timestamp extractor, but how do I extract from an other file other than the one being parsed? Is this even possible?

I don't want to do anything with start time, I just want to be able to show absolute and relative time on my events in Splunk. I got EndTime in my events so this is the time im using in all my graphs right now, EndTime is the relative time.

[lguinn2]

You don't need to define a timestamp extractor. I would update your props.conf as follows

[<stanza>]
LINE_BREAKER = (\<\?.+?\?\>)|(\<table name\=\".+?\"\>)|(\<\/table\>)|(\<row.*?\>)|(\<\/row\>)
KV_MODE = xml
sourcetype = xml
TRUNCATE = 0
TIME_PREFIX = \<StartTime>
MAX_TIMESTAMP_LOOKAHEAD = 15

[seam0n]

I think you have misunderstood what im looking for, the start time attribute only exists in one of the xml files. I have a xml database where only one "table" contains the time.