topic _time error in Getting Data In

_time error

asncari — Thu, 01 Feb 2024 13:05:56 GMT

Good afternoon,
I have a very strange problem. I have a log with these 2 events:

01/02/2024 13:06:16 - SOLISP1 IP: 10.229.87.80 USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0
01/02/2024 13:00:54 - GGCARO3 IP: 10.229.87.80 USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

The date format in the event is dd/mm/yyyy
Well, splunk indexes one of them in January and another in February. We have tried editing the props file as follows:

[default] TIME_PREFIX = ^ TIME_FORMAT = %d/%m/%Y %H:%M:%S

Anyone know what might be happening?

Re: _time error

gcusello — Thu, 01 Feb 2024 13:06:48 GMT

Hi @asncari,

probaly the options aren't applied to your sourcetype, please add them in a sourcetype, not to default, in props.conf:

[your_sourcetype] TIME_PREFIX = ^ TIME_FORMAT = %d/%m/%Y %H:%M:%S

Ciao.

Giuseppe

Re: _time error

asncari — Thu, 01 Feb 2024 13:13:08 GMT

I'll test it and tell you.

Thx Giuseppe

Re: _time error

asncari — Thu, 01 Feb 2024 13:34:36 GMT

Hi Giuseppe,

We have configured the props.conf with the sourcetype and the behavior is the same.

Thx Giuseppe.

Re: _time error

gcusello — Thu, 01 Feb 2024 13:39:35 GMT

hi @asncari,

there's no reason for this behavior!

Please, make a last try: remove TIME_PREFIX, restart Splunk and try again.

Ciao.

Giuseppe

Re: _time error

asncari — Thu, 01 Feb 2024 15:05:51 GMT

Hi, @gcusello

Without the props file it is how we originally had it and that is why I added it.

I am going to open a case with Broadcom support because this doesn't make sense.

If we can solve it, I will write it here so that it can be of use to other people.

Re: _time error

gcusello — Thu, 01 Feb 2024 15:17:50 GMT

Hi @asncari,

don't remove props.conf: leave it with

[<your_sourcetype>] TIME_FORMAT = %d/%m/%Y %H:%M:%S

Otherwise open a case to Splunk Support, sending them a diag.

Ciao.

Giuseppe