Hi, I am having the same issue as this one (https://answers.splunk.com/answers/27128/directory-and-config-file-permissions-keep-getting-reset-by-splunk-need-744.html) : my config files permissions keep being reset by Splunk. It is pretty old and seems unresolved, do you know if there is a way to avoid this ? Thanks ! ... View more

Hi, I noticed that if I send two times the exact same event, _time included, they are not merged. While investigating, I discoverd the _indextime field that could explain why they are considered as two different events. Is it possible to set the _indextime with the value of _time ? Will it "merge" my identical events ? And if not, is there a way to do it at indexation time ? Thanks ! ... View more

Hi, I noticed something strange. When I upload the following JSON by the Splunk Web interface, using he json_sales sourcetype described below, the "Date" field is set as timestamp (which is what I want). But when I try to push the same JSON line via HTTP event collector, the timestamp that is set is the indexation time. Where does it come from? How can I set the "Date" field as a timestamp while using HTTP? Thank you! JSON {"Date":"2018-02-26","Id commande":"L4512XXX","Type":"A","Quantité vendue":"1000","Support de vente":"Livre","Code pays":"FR","Référence":"REFXXX"} props.conf [json_sales] INDEXED_EXTRACTIONS = json KV_MODE = none NO_BINARY_CHECK = true TIMESTAMP_FIELDS = Date TIME_FORMAT = %Y-%m-%d category = Structured disabled = false pulldown_type = true cURL curl -k http://splunk:8088/services/collector -H "Authorization: Splunk 1c0afd4d-d882-4a2c-9fc2-0f428216XXXX" -d '{"sourcetype": "json_sales", "event": {"Date":"2018-02-26","Id commande":"L4512XXX","Type":"A","Quantité vendue":"1000","Support de vente":"Livre","Code pays":"FR","Référence":"REFXXX"}}' inputs.conf in splunk_httpinput/local [http://Vente] disabled = 0 index = sales token = 1c0afd4d-d882-4a2c-9fc2-0f428216XXXX sourcetype = json_sales ... View more

Hi! I have the following JSON and I would like to set the field "Date" as timestamp. Splunk is currently setting the date and time corresponding to when I index the data. JSON {"Date":"2018-02-26","Id commande":"L4512XXX","Type":"A","Quantité vendue":"1000","Support de vente":"Livre","Code pays":"FR","Référence":"REFXXX"} In order to set the field Date as timestamp, here is my configuration file : props.conf [json_sourcetype] KV_MODE = json NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = true TRUNCATE = 0 TIME_PREFIX = Date":" MAX_TIMESTAMP_LOOKAHEAD = 200 TIME_FORMAT = %Y-%m-%d But it is not working at all, it stills takes the indexation date as if this config was not taken into account. Do you know where it could come from? Thanks! ... View more