topic Re: Time extraction using props.conf in Getting Data In

Time extraction using props.conf

Glom — Wed, 09 Oct 2024 17:39:21 GMT

We have some events coming in to Splunk that show as following:

time="09/10/2024 11:41:15" URL="[Redacted String]" Name="[Redacted String]" Issuer="[Redacted String]" Issued="27/10/2023 13:27:22" Expires="26/10/2025 12:27:22"

Splunk is using ingest time instead of the time field. In props.conf for this sourcetype I have the following:

SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) TIME_PREFIX = time= TIME_FORMAT = "%d/%m/%Y %H:%M:%S" CHARSET = UTF-8 KV_MODE = none DISABLED = false

However the time isn't being extracted properly, what do I need to change / add?

Thanks.

Re: Time extraction using props.conf

dural_yyz — Wed, 09 Oct 2024 13:57:08 GMT

TIME_PREFIX is a regex match and they can get touchy sometimes. I would force the = and the " to be escaped so: TIME_PREFIX = time\=\". Then I would take advantage of the MAX_TIMESTAMP_LOOKAHEAD, although it should be inherited from the default I always like to put it in my app when I have multiple timestamps in the raw data.

Re: Time extraction using props.conf

Glom — Wed, 09 Oct 2024 14:15:07 GMT

Hi I modified the props.conf as recommended and no change, time is still being taken as ingest time:

SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) TIME_PREFIX = time\=\" TIME_FORMAT = "%d/%m/%Y %H:%M:%S" MAX_TIMESTAMP_LOOKAHEAD = 27 CHARSET = UTF-8 KV_MODE = none DISABLED = false

Any other ideas?

Re: Time extraction using props.conf

sainag_splunk — Wed, 09 Oct 2024 14:30:39 GMT

Please try to remove the " (double quotes) from the TIME_FORMAT.

TIME_FORMAT=%d/%m/%Y %H:%M:%S

If this isn't working checkout the btool on this source/host/sourcetype for any DATETIME_CONFIG setting on your props.conf.

Hope this helps.