Getting Data In

How to index an XML file with unix time format

almotasim90
New Member

I have XML files in my PC that I want to index them in Splunk, I need the inputs and the props.conf changed. I did everything but I am stock into line breaking events.
I have it in unix time format which is something like:

<Date_range>
<begin>1586965192</begin>
<end>1586965199</end>
</Date_range>

How to specify the time format !!?
and, I have no idea how to specify time format in my props.conf or transform.conf. if u have anything might help, please!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try these props

[myxml]
TIME_FORMAT = %s
TIME_PREFIX = \<begin>
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...