According to the post by saxon at the page referenced below, which should be authoritative since it appears to be from the site admin for JRobin, the timestamp represents the start of the interval.
http://oldwww.jrobin.org/phpBB2/viewtopic.php?t=71&sid=3bdadda9ebfdd8792a018665f32f253e
I've noticed, however, that Citrix will report incomplete intervals; that is, if you calculate the end of the interval (t + step), it will generally be in the future for the final entry (which comes first in the list for some reason). But comparing the values to the output of
date +%s
I never see values for the start/end/t tags which are in the future.
Is it possible that the clocks on the XenServer host and the host where you are looking at the data are off, or that the systems are in different timezones?
UPDATE: Hold on. As a test, I created a spike in network activity and then fetched metrics and looked for the spike. The t value appears to be the end of the interval, not the start as suggested above.
If anyone knows of a page that gives clear definitions of the XML tags returned by Citrix, please post a link.