Getting Data In

TIME_PREFIX in Splunk v6.1.2 props.conf ignored at times?

NK_1
Path Finder

C:\Program Files\Splunk\etc\system\local\props.conf contains

[YYY]
TIME_PREFIX = timestamp=
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)<log4j:event

The 6.1.2 docs indicate "If the TIME_PREFIX cannot be found in the event text, timestamp extraction does not take place."

A broken incoming raw event:

 DELETE FROM TABLE1  WHERE modified_date < TO_DATE('2014-07-21 17:59:59', 'YYYY-MM-DD HH24:MI:SS')
 Deleted 0 rows in (ms) 16 ]]></log4j:message>
</log4j:event>

Splunk appears to extract the slightly (by a couple of hours) future timestamp "2014-07-21 17:59:59" from the raw event (which is actually a SQL parameter) and uses that as the timestamp of the current event, instead of the current timestamp.

Is this a bug?

0 Karma
1 Solution

NK_1
Path Finder

Looks like the forwarder's sourcetype configs under
C:\Program Files\SplunkUniversalForwarder\etc\apps\learned\local\
had somehow "learned" an incorrect sourcetype definition for YYY that was correctly defined on the indexer.

Fixing those forwarder configs solved the broken event problem.

View solution in original post

0 Karma

NK_1
Path Finder

Looks like the forwarder's sourcetype configs under
C:\Program Files\SplunkUniversalForwarder\etc\apps\learned\local\
had somehow "learned" an incorrect sourcetype definition for YYY that was correctly defined on the indexer.

Fixing those forwarder configs solved the broken event problem.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...