topic Re: TIME_PREFIX configuration is not working in Getting Data In

TIME_PREFIX configuration is not working

bhsakarchourasi — Sat, 24 Dec 2022 03:13:42 GMT

Hi All,

We are working in Splunk Cloud environment, I want to deploy custom the TIME_PREFIX configuration for one of the log source, we have tested the configuration in Splunk stand alone box, it works fine, we have deployed the same configuration on Splunk Cloud indexers and IDM node, but it's not working.

Below is my props configuration.

TIME_PREFIX = "time":\s*"

MAX_TIMESTAMP_LOOKAHEAD = 128

sample value:

, "time": "2022-12-24T02:36:55.9183013Z",

My question is do I need to deploy this configuration on search heads as well.

Thanks,

Bhaskar

Re: TIME_PREFIX configuration is not working

gcusello — Sat, 24 Dec 2022 07:07:17 GMT

Hi @bhsakarchourasi.,

I'd use this TIME_PREFIX:

TIME_PREFIX = \"time\":\s*\"

Anyway, TIME_PREFIX should be on Forwarder, but I usually put it also on Search Head.

Ciao.

Giuseppe

Re: TIME_PREFIX configuration is not working

bhsakarchourasi — Sat, 24 Dec 2022 07:18:46 GMT

Hi,

Thanks for the reply, that's correct, regex can be changed as per your suggestion, can you also provide a logical explanation for having this configuration on search head. I not able to figure this out as far as I understood time prefix should work if it's present in Indexer and HF.

Thanks,

Bhaskar