Deployment Architecture

TIME_FORMAT on props.conf broke line breaking.

agodoy
Communicator

Hello,
I have timestamps in the following format.

1383058343.661030

I added the following to my props.conf.

TIME_FORMAT = %s%6N

This was in a Splunk cluster. After the bundle was applied, the events stopped breaking like they normally do. Instead they started to be grouped together.

Questions:

  1. Is the time format correct for the time stamp?
  2. Do I need to add other configs on the peer side to allow for proper line breaking.
0 Karma
1 Solution

kristian_kolb
Ultra Champion

You are missing the dot.

TIME_FORMAT = %s.%6N

/K

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

You are missing the dot.

TIME_FORMAT = %s.%6N

/K

0 Karma

agodoy
Communicator

I did indeed. Thanks!

0 Karma

kristian_kolb
Ultra Champion

And yes, this configuration is supposed to go to the indexers (or to a Heavy Forwarder - whichever comes first)

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

/K

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...