Splunk - Assigning custom time

gunnist — Fri, 20 Aug 2021 21:23:03 GMT

I want my time to be the "Date" property in the following json:

{ "Level": "ERROR", "Date": "2021-08-20 17:21:53.6355", "Logger":.... }

I created a props.conf here: ...\Splunk\etc\system\local with:

TIME_PREFIX = "Date":\s"
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N

I then restarted splunk...but it's not working. Any idea what I'm missing?

Re: Splunk - Assigning custom time

richgalloway — Sat, 21 Aug 2021 00:12:59 GMT

The current settings say Splunk should find a 4-digit year immediately following '"Date":', but that's not the case. Try TIME_PREFIX = "Date":\s". There's no need to escape the quotation marks.

topic Splunk - Assigning custom time in Getting Data In

Splunk - Assigning custom time

Re: Splunk - Assigning custom time