I'm running into an issue with Splunk ignoring the timestamp in a specific log and just using current indexing time. Example extract(XXXX and #### replace letters and numbers)
[2011-09-27-04-03-54][XXXX::IA::Actions][####]: BUYER_EMAIL_INVOICES_ADDRESS: []
[2011-09-27-04-03-54][XXXX::IA::Actions][####]: BUYER_LANGUAGE_ID: [25]
[2011-09-27-04-03-54][XXXX::IA::Actions][####]: BUYER_DATE_FORMAT_ID: [1]
Format is %Y-%m-%d-%H-%M-%S
I've attempted the below dateformat to resolve this (there is a backslash escaping the [ below, it's being removed):
TIME_PREFIX = [
TIME_FORMAT = %Y-%m-%d-%H-%M-%S
Unfortunately, no luck, and it's still showing up with the indexing time.
Any help on this? I'm running into a wall.
Colin, try placing a ^ (to indicate the beginning of the line) in front of the backslash escaping your left bracket in TIME_PREFIX.
Where exactly did you place these lines of configuration?
I've adjusted props.conf on the backend, but it did not work properly. At this point, it now groups them into chunks of 16 lines as a single event and continues to give them the wrong timestamp.
I added them to the props.conf on the forwarder. Should the props.conf be added to the indexer too, or just the forwarder?