I have XML files in my PC that I want to index them in Splunk, I need the inputs and the props.conf changed. I did everything but I am stock into line breaking events.
I have it in unix time format which is something like:
<Date_range>
<begin>1586965192</begin>
<end>1586965199</end>
</Date_range>
How to specify the time format !!?
and, I have no idea how to specify time format in my props.conf or transform.conf. if u have anything might help, please!!
Try these props
[myxml]
TIME_FORMAT = %s
TIME_PREFIX = \<begin>