<?xml version="1.0"?><Transmission xmlns="http://xxx.oracle.com/apps/xxx"><TransmissionHeader><Version>6.3.7</Version><TransmissionCreateDt><GLogDate>20161115035429</GLogDate>
When i add a sample log file, Splunk is unable to parse the timestamp. What should be the sourcetype setting so it can parse the timestamp correctly?
You need to setup your custom sourcetype with following
TIME_PREFIX = \<GLogDate\>
TIME_FORMAT = %Y%m%d%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 14