https://community.splunk.com/t5/Deployment-Architecture/Splunk-deployment/m-p/688081#M28210 <P>My splunk web service is cannot recognize my source type in props.conf file when I try to add data. Here is my props.conf file's content:</P> <LI-CODE lang="markup">[Test9] TIME_PREFIX=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s\-\s\d{5}\s+ TIME_FORMAT = %m/%d/%Y %k:%M MAX_TIMESTAMP_LOOKAHEAD = 15 LINE_BREAKER = ([\r\n]+)\d+\s+\"\$EIT\, SHOULD_LINEMERGE = false TRUNCATE = 99999</LI-CODE> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30887iA2BA107AA2F0F44F/image-size/large?v=v2&amp;px=999" role="button" title="splunk.png" alt="splunk.png" /></span></P> <P>my props.conf file path is:&nbsp;C:\Program Files\Splunk\etc\apps\test\local</P> <P>&nbsp;</P> Mon, 20 May 2024 20:41:34 GMT Vladislav 2024-05-20T20:41:34Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-deployment/m-p/688081#M28210 <P>My splunk web service is cannot recognize my source type in props.conf file when I try to add data. Here is my props.conf file's content:</P> <LI-CODE lang="markup">[Test9] TIME_PREFIX=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s\-\s\d{5}\s+ TIME_FORMAT = %m/%d/%Y %k:%M MAX_TIMESTAMP_LOOKAHEAD = 15 LINE_BREAKER = ([\r\n]+)\d+\s+\"\$EIT\, SHOULD_LINEMERGE = false TRUNCATE = 99999</LI-CODE> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30887iA2BA107AA2F0F44F/image-size/large?v=v2&amp;px=999" role="button" title="splunk.png" alt="splunk.png" /></span></P> <P>my props.conf file path is:&nbsp;C:\Program Files\Splunk\etc\apps\test\local</P> <P>&nbsp;</P> Mon, 20 May 2024 20:41:34 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-deployment/m-p/688081#M28210 Vladislav 2024-05-20T20:41:34Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-deployment/m-p/688090#M28211 <P>What message lurks beneath the yellow triangles?</P><P>There are a few concerns:</P><P>1) The event timestamps may be too old to extract properly</P><P>2) MAX_TIMESTAMP_LOOKAHEAD of 15 is too short for times after 9:59</P><P>3) The sourcetype name is "Test9" in props.conf, but "test9" is selected in the wizard.&nbsp; Sourcetypes are case-sensitive by default.</P> Tue, 21 May 2024 00:21:44 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-deployment/m-p/688090#M28211 richgalloway 2024-05-21T00:21:44Z