Getting Data In

Why is Splunk not respecting the TIME_FORMAT in props.conf?

gsmi
New Member

I have a log message which starts with a time stamp. Splunk is automatically extracting this and indexing the messages with the wrong date and time.

For example the following message would have been indexed with the date of 11th July 2018 17:22.27 instead of 7th of Nov 2018 16:22.27 UTC

07/11/2018 17:22:27.837 Log_Level=WARN ...............

I have added a time zone and TIME_FORMAT regex in the props.conf of my app to try an correct this but for some reason Splunk is not respecting it.

my props.conf looks like

[IDSAlert]
EXTRACT-message = ^(?:[^=\n]*=){10}(?P<message>.+)
DATETIME_CONFIG =
NO_BINARY_CHECK = true
TIME_FORMAT = %d/%m/%Y %H:%M:%S.%3N
TZ = UTC
category = Custom
disabled = false
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It may help to add the following lines to the [IDSAlert] stanza:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 23

Be sure to restart the indexers and heavy forwarders after editing props.conf or the changes will not be respected.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It may help to add the following lines to the [IDSAlert] stanza:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 23

Be sure to restart the indexers and heavy forwarders after editing props.conf or the changes will not be respected.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gsmi
New Member

I had the props.conf in an app on the search head, moving to the heavy forwarders and restarting them worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...