Getting Data In

How can I set a TIME_PREFIX without prefix

nicolasydder
Explorer

Hi folks,

I wanted to add the first field as timestamp :

150503;ULSTTTK073TTTXXX;XXXXXXXX;15/04/27;13:11:35  

but my stanza in my props.conf doesn't match this field...

[my_stanza]
TIME_FORMAT=%y%m%d
TIMESTAMP_FIELDS = DDATFCT
TIME_PREFIX = 
MAX_TIMESTAMP_LOOKAHEAD=50
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
KV_MODE=none
disabled=false
pulldown_type=true

A transforms.conf is used to set FIELD_NAME with DDATFCT as first element.

Do I set a null TIME_PREFIX to force to recognize my timestamp fields ?
Be aware that time fields doesn't have any prefixe...

BR

Nicolas Y.

0 Karma
1 Solution

woodcock
Esteemed Legend

woodcock
Esteemed Legend

TIME_PREFIX = ^

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...