Getting Data In

Please write Props for the following data because time format not working

muez
Explorer

Below is data :

30,01/21/20,11:56:24,DNS Update Request,ip,xxx,,,0,6,,,,,,,,,0
11,01/21/20,11:56:24,Renew,ip,xxx,4889E71C9936,,3085275568,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
36,01/21/20,11:56:24,Packet dropped because of Client ID hash mismatch or standby server.,ip,,105BADA1EB57,,0,6,,,,,,,,,0

Please write props conf for this type of data.
According to splunk, from new year, splunk has stopped recognising two digit time stamps automatically.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @muez,
try this props.conf

[your_sourcetype]
TIME_PREFIX = \d\d,
TIME_FORMAT = %m/%d/%y,%H:%M:%S

If you haven't Splunk 8.0.1, remember to update datetime.xml following the Splunk Support instructions ( https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020?elqTrackId=29cfe... ).

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @muez,
try this props.conf

[your_sourcetype]
TIME_PREFIX = \d\d,
TIME_FORMAT = %m/%d/%y,%H:%M:%S

If you haven't Splunk 8.0.1, remember to update datetime.xml following the Splunk Support instructions ( https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020?elqTrackId=29cfe... ).

Ciao.
Giuseppe

muez
Explorer

props is not working, i think I have to follow Splunk Instructions. Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @muez,
where do you used the props.conf? it must be on Indexer or (when present) on Heavy Forwarder not on Universal Forwarder and then you have to restart Splunk.

Ciao.
Giuseppe

0 Karma

muez
Explorer

We have heavy forwarders where we write props everytime. It doesnt work 😞

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @muez,
your data seems to be structured data, do they come from a csv?
In this case, put props.conf on Universal Forwarder that ingests csv.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...