https://community.splunk.com/t5/Getting-Data-In/props-conf-time-format-appears-to-be-ignored-even-though-data/m-p/110000#M23119 <P>Hello, I've been banging my head against a wall trying to figure out this problem and haven't been able to make any progress. My props.conf file has the following:</P> <PRE><CODE>[source::.../query_logs/AP-*.log] MAX_TIMESTAMP_LOOKAHEAD = 12 NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_FORMAT = %y%m%d%H%M%S TZ = America/Los_Angeles sourcetype = appid_query_log </CODE></PRE> <P>And the file being indexed that matches the source above is:</P> <PRE><CODE>140903094720|crf-room-p88a92b5 |room | 10. 74.126.225|danchen |danchen 140903110402|crf-room-p88a92b5 |room | 10. 73.214. 82| | 140903110403|crf-room-p88a92b5 |room | 10. 73.214. 82| | </CODE></PRE> <P>Where the number at the beginning is the date in the format YYMMDDHHMMSS. I've tested it in data preview and the above props.conf settings worked perfectly - however, when I save those settings to props.conf on the forwarder, clear the fishbowl and restart, it still indexes that number as a UNIX timestamp instead of using the format I've told it to use. I know it is using the [source::.../query_logs/AP-*.log] directive because it is correctly assigning the sourcetype to those files.</P> <P>Any ideas what I'm missing?</P> Wed, 03 Sep 2014 19:57:30 GMT msbware 2014-09-03T19:57:30Z https://community.splunk.com/t5/Getting-Data-In/props-conf-time-format-appears-to-be-ignored-even-though-data/m-p/110000#M23119 <P>Hello, I've been banging my head against a wall trying to figure out this problem and haven't been able to make any progress. My props.conf file has the following:</P> <PRE><CODE>[source::.../query_logs/AP-*.log] MAX_TIMESTAMP_LOOKAHEAD = 12 NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_FORMAT = %y%m%d%H%M%S TZ = America/Los_Angeles sourcetype = appid_query_log </CODE></PRE> <P>And the file being indexed that matches the source above is:</P> <PRE><CODE>140903094720|crf-room-p88a92b5 |room | 10. 74.126.225|danchen |danchen 140903110402|crf-room-p88a92b5 |room | 10. 73.214. 82| | 140903110403|crf-room-p88a92b5 |room | 10. 73.214. 82| | </CODE></PRE> <P>Where the number at the beginning is the date in the format YYMMDDHHMMSS. I've tested it in data preview and the above props.conf settings worked perfectly - however, when I save those settings to props.conf on the forwarder, clear the fishbowl and restart, it still indexes that number as a UNIX timestamp instead of using the format I've told it to use. I know it is using the [source::.../query_logs/AP-*.log] directive because it is correctly assigning the sourcetype to those files.</P> <P>Any ideas what I'm missing?</P> Wed, 03 Sep 2014 19:57:30 GMT https://community.splunk.com/t5/Getting-Data-In/props-conf-time-format-appears-to-be-ignored-even-though-data/m-p/110000#M23119 msbware 2014-09-03T19:57:30Z https://community.splunk.com/t5/Getting-Data-In/props-conf-time-format-appears-to-be-ignored-even-though-data/m-p/110001#M23120 <P>Apparently all I needed to do to get it figured out was to post a question about it. After doing so, I found this related post ( <A href="http://answers.splunk.com/answers/59447/time_format-ignored">http://answers.splunk.com/answers/59447/time_format-ignored</A> ) and discovered that the indexer is actually doing the parsing, not the forwarder (which is where my props.conf was). I moved the configuration to the indexer and it worked!</P> Wed, 03 Sep 2014 20:10:51 GMT https://community.splunk.com/t5/Getting-Data-In/props-conf-time-format-appears-to-be-ignored-even-though-data/m-p/110001#M23120 msbware 2014-09-03T20:10:51Z