How to tel Splunk to index based on second column(Timestamp) instead of column(Server Started). This is causing data to be index to old data May 26,2017 instead of Aug 25.
I want to fix it from Splunk UI only. Please advice
Server Started Timestamp Document Type User Message Id Session
2017-05-26 18:51:20 2017-08-25 09:08:53 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Document XXRPXX\U123456 Open Document\SHDashboard 10009
2017-05-26 18:51:20 2017-08-25 09:08:53 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Sheet XXRPXX\U123456 Activated sheet Document\SHSessionHeatmap 10009
2017-05-26 18:51:20 2017-08-25 09:08:54 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Bookmark XXRPXX\U123456 Apply Server\BM02-00 10009
2017-05-26 18:51:20 2017-08-25 09:33:28 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Document XXRPXX\U123456 Close Document\SHSessionHeatmap 10009
Not possible to fix from the frontend.. This can only be done on the backend
You should apply these base configs to your props.conf
and should then restart splunkd.. Also make sure to replace my_sourcetype
with your sourcetype you specified in inputs.conf
[my_sourcetype]
TIME_PREFIX = ^\d{4}-\d+-\d+\s\d+:\d+:\d+\s
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %Y-%m-%d %H:%M:%S
LINE_BREAKER = ([\r\n]+)\d{4}-\d+-\d+\s
SHOULD_LINEMERGE = False
TRUNCATE = 10000
The TIME_PREFIX
attribute is telling Splunk to start after the first timestamp and only pick up the second timestamp
Please give me details from front end to add the required fix .
Did the below answer solve your question? If so, can you click accept?