topic Problem with timestamp extraction and props.conf in Getting Data In

Problem with timestamp extraction and props.conf

alferone — Wed, 30 Oct 2024 16:54:24 GMT

I have the following props which works fine in the "Add Data" GUI and a test file of logs:

EVENT_BREAKER = ([\r\n]+)\<.+\>\w{2,4}\s\d{1,2}\s EVENT_BREAKER_ENABLE = true LINE_BREAKER = ([\r\n]+)\<.+\>\w{2,4}\s\d{1,2}\s MAX_TIMESTAMP_LOOKAHEAD = 25 SHOULD_LINEMERGE = false TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N TIME_PREFIX = named\[.+\]\:\s TRUNCATE = 99999 TZ = US/Eastern

I am trying to pull milliseconds from the log using the 2nd timestamp.

<30>Oct 30 11:31:39 172.1.1.1 named[18422]: 30-Oct-2024 11:31:39.731 client 1.1.1.1#1111: view 10: UDP: query: 27b9eb69be0574d621235140cd164f.test.com IN A response: NOERROR +EDV 27b9eb69be0236356140cd164f.test.com. 30 IN CNAME waw-test.net.; waw-mvp.test.net. 10 IN A 41.1.1.1; test.net. 10 IN A 1.1.1.1; test.net. 10 IN A 1.1.1.1; test.net. 10 IN A 1.1.1.1;

I have this loaded on the indexers and search heads. But it is still pulling from the first timestamp.

A btool on the indexers shows this line that I have not configured.:

DATETIME_CONFIG = /etc/datetime.xml

Is this what is screwing me up?

Thank you!

Re: Problem with timestamp extraction and props.conf

richgalloway — Wed, 30 Oct 2024 18:51:29 GMT

Try setting

DATETIME_CONFIG =

in props.conf to disable the automatic timestamp extractor.

Re: Problem with timestamp extraction and props.conf

alferone — Wed, 30 Oct 2024 20:22:27 GMT

I'll take a look, and thank you!

Re: Problem with timestamp extraction and props.conf

isoutamo — Sat, 02 Nov 2024 15:02:54 GMT

Hi
Are you sure that indexers are the first full splunk instance from your source? If there is any like HF before indexers then you must add that props.conf there as it has effected only in 1st full splunk instance.
r. Ismo