Splunk Enterprise

How to tel Splunk to index based on second column(Timestamp) instead of column(Server Started)

smdasim
Explorer

How to tel Splunk to index based on second column(Timestamp) instead of column(Server Started). This is causing data to be index to old data May 26,2017 instead of Aug 25.
I want to fix it from Splunk UI only. Please advice

Server Started Timestamp Document Type User Message Id Session
2017-05-26 18:51:20 2017-08-25 09:08:53 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Document XXRPXX\U123456 Open Document\SHDashboard 10009
2017-05-26 18:51:20 2017-08-25 09:08:53 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Sheet XXRPXX\U123456 Activated sheet Document\SHSessionHeatmap 10009
2017-05-26 18:51:20 2017-08-25 09:08:54 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Bookmark XXRPXX\U123456 Apply Server\BM02-00 10009
2017-05-26 18:51:20 2017-08-25 09:33:28 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Document XXRPXX\U123456 Close Document\SHSessionHeatmap 10009

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Not possible to fix from the frontend.. This can only be done on the backend

You should apply these base configs to your props.conf and should then restart splunkd.. Also make sure to replace my_sourcetype with your sourcetype you specified in inputs.conf

[my_sourcetype]
TIME_PREFIX = ^\d{4}-\d+-\d+\s\d+:\d+:\d+\s
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %Y-%m-%d %H:%M:%S
LINE_BREAKER = ([\r\n]+)\d{4}-\d+-\d+\s
SHOULD_LINEMERGE = False
TRUNCATE = 10000

The TIME_PREFIX attribute is telling Splunk to start after the first timestamp and only pick up the second timestamp

0 Karma

smdasim
Explorer

Please give me details from front end to add the required fix .

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Did the below answer solve your question? If so, can you click accept?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...