Hi, novice splunker here.
I'm having an issue in getting all the timestamps correctly parsed from the DATE and TIME fields of a given xml log.
That xml log contains exactly 68 short records of dummy client transactions. Some are parsed correctly, some incorrectly.
**props.conf**:
[xml_log]
TIME_PREFIX =
TIME_FORMAT = %d%m%Y %n
↧