The heavy forwarders we are leveraging appear to be ignoring the props.conf file, resulting in timestamp extraction issue. This particular input is through HEC.
I managed to use "splunk btool props list" to verify that the props values are loaded to memory, but I do not see any evidence that it's being used.
Sourcetype headings match.
Thanks in advance!
... View more