Getting Data In

props.conf not recursing all directories

pljulien
New Member

I'm trying to go down a line of directories to get the syslog files. The recursion works for year 2013. To make sure it works for other years copied 2013 files to 2012 and changed year in all in all files. When doing search with all time Splunk doesn't see 2012.

props.conf
[source:: HOSTS.../*.logfile
sourcetype = syslog
TIME_FORMAT = %m %d %H:%M:%D

Any assistance would be appreciated.

Tags (1)
0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

Are you trying to define an input with your [source...] statement? Because that's wrong.

In a props.conf, the [source...] statement is meant only to define what group of events to apply the props to.

You'd want to create an inputs.conf with something like this in it:

[monitor:///HOSTS.../*.logfile]
sourcetype = syslog

And then, if your syslog is properly formatted, you won't even need a props.conf stanza for that.

0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

Ok.

Is your TIME_FORMAT correct? The standard TIME_FORMAT for the syslog sourcetype is:

TIME_FORMAT = %b %d %H:%M:%S

Which expects a month abbreviation (i.e. Jun, Nov, etc), then the day. Yours expects a timestamp like 12 09 16:27:00, which seems odd.

0 Karma

pljulien
New Member

Data is in a file. In inputs.conf I have:

[monitor:///opt/splunk/data/test/HOSTS/.../*.logfile]
index=test
sourcetype = syslog

When I didn't have the props.conf my data was coming in as the date of file, so created a props.conf file, fat-fingered above. It is:

[source:///opt/splunk/data/HOSTS/.../*.logfile]
sourcetype = syslog
TIME_FORMAT = %d %m %H:%M:%S

The directory structure is - .../HOSTS//year/month/day.logfile. The 2 files configured as noted, only getting data for 2013 and not 2012. Search set to all time. Any suggestions on changes to this would be appreciated.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...