Hi, Trying to learn SPLUNK and I have troubles with timestamp, My XML CODE is like this : <LOG><DATUM>26112022</DATUM><Vrijeme>224516</Vrijeme><CC>6894542532143100</CC><Iznos>46144.46</Iznos></LOG> I got the date (DATUM) and now im trying to get the time, but my problem is I can't go to next line props file looks like this SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]*)<\w{2,}> TIME_PREFIX = <DATUM> TIME_FORMAT = %d%m%Y</DATUM>\n<Vrijeme>%H%M%S MAX_TIMESTAMP_LOOKAHEAD = 100 instead of "\n" i tried %n, [\r\n\s], and leave it blank, but nothing works, any tips? ... View more