Getting Data In

How do I correct my configurations for proper Splunk timestamp recognition?

geantvert007
Explorer

Hi,

I have a problem with the Splunk timestamp.

I know that when you have a problem with timestamp, you can modify this 2 ways:
1. Add data and modify the timestamp during the steps of adding manually data on Splunk.

2. Modify the props.conf

The problem :
alt text

As we can see, on my log, the real timestamp is not the same compared to the timestamp recognized by Splunk.

For the First Way:

  • 1.1 Adding Data manually and modify the timestamp steps by steps : alt text

As we can see, Splunk recognizes the time, but not the date correctly, so I will modify the timestamp with the parameter on the left ( prefix and format)

  • 1.2 So I will add the correct parameter: alt text

--> I add the format and prefix, Splunk seem to recognize this correctly
(but the prefix is strange because it works also when I write d{2}; or d{1}; or d*; ... )

  • At the final step, when I apply this ... nothing works after when I want to search something or when i just want to look the logs event. Nothing happens and I see the message that Splunk is waiting for queued job to start.

For the Second Way

  • edit props.conf

    • There is so many props.conf, so to be sure, which one do I have to modify? I guess this one: Splunk/etc/apps/search/local ?
    • And what do I have to add exactly? I guess it is TIME_PREFIX = ... and TIME_FORMAT=...

Then after adding these parameters with the values, is there something else to modify to complete the configuration? Because even with this way, nothing happens and that doesn't work for me.


I missed something maybe, but I don't know what...

Kind Regards

Steve

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

In Add data wizard, add following parameters. Same things can be added to props.conf directly as well.

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\d+;\S+
TIME_FORMAT = %d%a%Y %H:%M:%S
TIME_PREFIX = ^\d+;

Remember to restart Indexer/Heavy forwarder where you keep this props.conf

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

In Add data wizard, add following parameters. Same things can be added to props.conf directly as well.

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\d+;\S+
TIME_FORMAT = %d%a%Y %H:%M:%S
TIME_PREFIX = ^\d+;

Remember to restart Indexer/Heavy forwarder where you keep this props.conf

geantvert007
Explorer

Great thanks for your help guys 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The props.conf file to modify is the one for the app that will process the events. If it's the Search & Reporting app then SPLUNK_HOME/etc/apps/search/local/props.conf is the correct file. You should not need TIME_PREFIX. It should be enough to set TIME_FORMAT=%d%a%Y %H:%M:%S. Note that you must restart Splunk for the change to take effect and the change only applies to new data (nothing can be done about events that are already in Splunk).

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...