I'm trying to go down a line of directories to get the syslog files. The recursion works for year 2013. To make sure it works for other years copied 2013 files to 2012 and changed year in all in all files. When doing search with all time Splunk doesn't see 2012.
props.conf
[source:: HOSTS.../*.logfile
sourcetype = syslog
TIME_FORMAT = %m %d %H:%M:%D
Any assistance would be appreciated.
Are you trying to define an input with your [source...] statement? Because that's wrong.
In a props.conf, the [source...] statement is meant only to define what group of events to apply the props to.
You'd want to create an inputs.conf with something like this in it:
[monitor:///HOSTS.../*.logfile]
sourcetype = syslog
And then, if your syslog is properly formatted, you won't even need a props.conf stanza for that.
Ok.
Is your TIME_FORMAT correct? The standard TIME_FORMAT for the syslog sourcetype is:
TIME_FORMAT = %b %d %H:%M:%S
Which expects a month abbreviation (i.e. Jun, Nov, etc), then the day. Yours expects a timestamp like 12 09 16:27:00, which seems odd.
Data is in a file. In inputs.conf I have:
[monitor:///opt/splunk/data/test/HOSTS/.../*.logfile]
index=test
sourcetype = syslog
When I didn't have the props.conf my data was coming in as the date of file, so created a props.conf file, fat-fingered above. It is:
[source:///opt/splunk/data/HOSTS/.../*.logfile]
sourcetype = syslog
TIME_FORMAT = %d %m %H:%M:%S
The directory structure is - .../HOSTS/