Props.conf - Timestamp extraction failed

_olivier_ — Tue, 17 Sep 2024 09:21:05 GMT

Hi splunkers ! I m facing an issue that is going to make me crazy ! I've got to set the timestamp in the following logs (timestamp field is the 11th field, the first one being the insert time by the proxy himself) : 2024-09-16T13:12:54+02:00 Logging-Client

"-1","username","1.2.3.4","POST","872","2211","www.facebook.com","/csp/reporting/","OBSERVED","","1726484997","2024-09-16 11:09:57","https","Social Networking","application/x-empty","","Minimal Risk","Remove 'X-Forwarded-For' Header","200","10.97.5.240","","","Firefox","102.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0","firefox.exe","1.2.3.4","443","US","","t","t","t","f","f","computerName","","1.2.3.4","1.2.3.4","8080"

So, I'm using a regex to extract fields and set the real timestamp in my props.conf :

[mySourcetype] SHOULD_LINEMERGE = false EXTRACT-mySourcetype = ^[^,\n]*,"(?P\w+)","(?P[^"]+)","(?P\w+)","(?P[^"]+)[^,\n]*,"(?P[^"]+)[^,\n]*,"(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)"$ TIME_PREFIX = (?:[^,]+,){11} TIME_FORMAT = %Y-%m-%d %H:%M:%S

Then, Ive got different results based on different source:

Upload a file directly in the search head

Extraction Ok Timestamp OK

File red from an universal forwarder

Extraction OK Timestamp Failed

The is NO heavy forwarder between the UF and the indexers.

The props.conf is deployed only on the SearchHeads. So, Something is tricky here !

If someone got an idea, I will apreciate ! Cheers.

Re: Props.conf - Timestamp extraction failed

gcusello — Tue, 17 Sep 2024 14:55:42 GMT

Hi @_olivier_ ,

it seems to be a comma separated file, in this case, you must put props.conf also in the UF.

Ciao.

Giuseppe

topic Re: Props.conf - Timestamp extraction failed in Getting Data In

Props.conf - Timestamp extraction failed

Re: Props.conf - Timestamp extraction failed