Hello,
I'm having some issue with the configuration on one of my source. Even after configuring the props.conf, events are not broken properly.
Format of my source :
09:39:37.889 INFO [main] Instantiated BDPeriodicAgent - o.i.p.m.b.s.impl.BDPeriodicAgent:57
09:39:37.921 DEBUG [main] Started meeting lifecycle agent to run every 36000 s - o.i.p.w.m.bd.servlet.BDInitServlet:64
My props.conf is the following:
MAX_TIMESTAMP_LOOKAHEAD = 150
NO_BINARY_CHECK = 1
TIME_FORMAT = %H:%M:%S.%3N
When I try to add the file from the Splunk interface and add this configuration to the "Advanced mode", events are shown properly. But when the same file is coming from the forwarder it looks like the props.conf is not taken in account and event are not split on the timestamp
Any advice?
Kind regards
... View more