topic Re: props.conf not recursing all directories in Getting Data In

props.conf not recursing all directories

pljulien — Thu, 12 Sep 2013 19:00:30 GMT

I'm trying to go down a line of directories to get the syslog files. The recursion works for year 2013. To make sure it works for other years copied 2013 files to 2012 and changed year in all in all files. When doing search with all time Splunk doesn't see 2012.

props.conf
[source:: HOSTS.../*.logfile
sourcetype = syslog
TIME_FORMAT = %m %d %H:%M:%D

Any assistance would be appreciated.

Re: props.conf not recursing all directories

mloven_splunk — Thu, 12 Sep 2013 19:17:49 GMT

Are you trying to define an input with your [source...] statement? Because that's wrong.

In a props.conf, the [source...] statement is meant only to define what group of events to apply the props to.

You'd want to create an inputs.conf with something like this in it:

[monitor:///HOSTS.../*.logfile]
sourcetype = syslog

And then, if your syslog is properly formatted, you won't even need a props.conf stanza for that.

Re: props.conf not recursing all directories

pljulien — Thu, 12 Sep 2013 21:12:13 GMT

Data is in a file. In inputs.conf I have:

[monitor:///opt/splunk/data/test/HOSTS/.../*.logfile]
index=test
sourcetype = syslog

When I didn't have the props.conf my data was coming in as the date of file, so created a props.conf file, fat-fingered above. It is:

[source:///opt/splunk/data/HOSTS/.../*.logfile]
sourcetype = syslog
TIME_FORMAT = %d %m %H:%M:%S

The directory structure is - .../HOSTS//year/month/day.logfile. The 2 files configured as noted, only getting data for 2013 and not 2012. Search set to all time. Any suggestions on changes to this would be appreciated.

Re: props.conf not recursing all directories

mloven_splunk — Mon, 28 Sep 2020 14:46:06 GMT

Ok.

Is your TIME_FORMAT correct? The standard TIME_FORMAT for the syslog sourcetype is:

TIME_FORMAT = %b %d %H:%M:%S

Which expects a month abbreviation (i.e. Jun, Nov, etc), then the day. Yours expects a timestamp like 12 09 16:27:00, which seems odd.