How to configure props.conf for Splunk to recognize all timestamps in these logs?

smudge797 — Tue, 21 Oct 2014 17:06:55 GMT

Splunk is not recognizing the timestamps in these logs. Some are picked up but others are grouped together into a single entry.
actual time stamp is in this format: 10/06/2014 10:34:36.595
Can you help provide the stanza needed for props.conf

15.184.187.23.1412616876595.2742797,15.184.187.23.1412616876595.2742797.HOOSd,18,0,HOOSd,10/06/2014 10:34:36.595
15.184.187.23.1412616899080.2742802,15.184.187.23.1412616899080.2742802.HOOSd,12,0,HOOSd,10/06/2014 10:34:59.080
15.184.187.23.1412616837048.2742766,15.184.187.23.1412616837048.2742766.ReconfirmSd,10,2,ReconfirmSd,10/06/2014 10:35:13.939
15.184.187.23.1412616837048.2742766,15.184.187.23.1412616837048.2742766.SelfServiceMainSd,15,1,SelfServiceMainSd,10/06/2014 10:34:23.845
15.184.187.23.1412616944893.2742809,15.184.187.23.1412616944893.2742809.PlayPrompt,9,0,PlayPrompt,10/06/2014 10:35:44.893
15.184.187.23.1412616958018.2742810,15.184.187.23.1412616958018.2742810.PlayPrompt,4,0,PlayPrompt,10/06/2014 10:35:58.018
15.184.187.23.1412616971362.2742811,15.184.187.23.1412616971362.2742811.CVPPlayPromptv2,3,0,CVPPlayPromptv2,10/06/2014 10:36:11.362
15.184.187.23.1412616838939.2742772,15.184.187.23.1412616838939.2742772.CancelBookingSd,10,2,CancelBookingSd,10/06/2014 10:35:11.643
15.184.187.23.1412616838939.2742772,15.184.187.23.1412616838939.2742772.SelfServiceMainSd,16,1,SelfServiceMainSd,10/06/2014 10:34:21.658
15.184.187.23.1412617011284.2742812,15.184.187.23.1412617011284.2742812.HOOSd,0,0,HOOSd,10/06/2014 10:36:51.284
15.184.187.23.1412647288591.2742813,15.184.187.23.1412647288591.2742813.CVPgetTestTFN,0,0,CVPgetTestTFN,10/06/2014 19:01:28.591
15.184.187.23.1412647444780.2742814,15.184.187.23.1412647444780.2742814.CVPgetTestTFN,0,0,CVPgetTestTFN,10/06/2014 19:04:04.780
15.184.187.23.1412647453406.2742815,15.184.187.23.1412647453406.2742815.GetExperienceSd,0,0,GetExperienceSd,10/06/2014 19:04:13.406
15.184.187.23.1412647454062.2742816,15.184.187.23.1412647454062.2742816.CVPDefaultsMenu,0,0,CVPDefaultsMenu,10/06/2014 19:04:14.062
15.184.187.23.1412647458328.2742817,15.184.187.23.1412647458328.2742817.CVPDefaultsMenu,0,0,CVPDefaultsMenu,10/06/2014 19:04:18.328
15.184.187.23.1412647463359.2742818,15.184.187.23.1412647463359.2742818.CVPDefaultsMenu,0,0,CVPDefaultsMenu,10/06/2014 19:04:23.359
15.184.187.23.1412647574720.2742819,15.184.187.23.1412647574720.2742819.CVPgetTestTFN,0,0,CVPgetTestTFN,10/06/2014 19:06:14.720
15.184.187.23.1412647583798.2742820,15.184.187.23.1412647583798.2742820.GetExperienceSd,0,0,GetExperienceSd,10/06/2014 19:06:23.798
15.184.187.23.1412647584548.2742821,15.184.187.23.1412647584548.2742821.CVPDefaultsMenu,0,0,CVPDefaultsMenu,10/06/2014 19:06:24.548
15.184.187.23.1412647589798.2742822,15.184.187.23.1412647589798.2742822.CVPDefaultsMenu,0,0,CVPDefaultsMenu,10/06/2014 19:06:29.798
15.184.187.23.1412647592095.2742823,15.184.187.23.1412647592095.2742823.CVPDefaultsMenu,0,0,CVPDefaultsMenu,10/06/2014 19:06:32.095

Re: How to configure props.conf for Splunk to recognize all timestamps in these logs?

sowings — Tue, 21 Oct 2014 17:36:42 GMT

You just need a TIME_FORMAT. The time stamp is occurring about 90 chars in, which is below the default MAX_TIMESTAMP_LOOKAHEAD of 128 chars. A suggested format reads as "%m/%d/%Y %H:%M:%S.%3N".

Splunk is probably confused by the epoch time in milliseconds (with 7 more sigfigs of sub-millisecond appended) occurring in second position. Set the TIME_FORMAT explicitly and you should be in good shape.

Re: How to configure props.conf for Splunk to recognize all timestamps in these logs?

smudge797 — Mon, 28 Sep 2020 17:57:16 GMT

So in data preview these three events get grouped together as a single events using:

MAX_TIMESTAMP_LOOKAHEAD = 128
TIME_FORMAT = %m/%d/%Y %H:%M:%S.%3N

15.184.187.23.1412616971362.2742811,15.184.187.23.1412616971362.2742811.CVPPlayPromptv2,3,0,CVPPlayPromptv2,10/06/2014 10:36:11.362
15.184.187.23.1412616838939.2742772,15.184.187.23.1412616838939.2742772.CancelBookingSd,10,2,CancelBookingSd,10/06/2014 10:35:11.643
15.184.187.23.1412616838939.2742772,15.184.187.23.1412616838939.2742772.SelfServiceMainSd,16,1,SelfServiceMainSd,10/06/2014 10:34:21.658

Re: How to configure props.conf for Splunk to recognize all timestamps in these logs?

sowings — Tue, 21 Oct 2014 18:01:06 GMT

Data preview may be wrong in this case. The other setting you could use is "SHOULD_LINEMERGE = false", since this data appears to be single-event-per-line.

topic Re: How to configure props.conf for Splunk to recognize all timestamps in these logs? in Getting Data In

How to configure props.conf for Splunk to recognize all timestamps in these logs?

Re: How to configure props.conf for Splunk to recognize all timestamps in these logs?

Re: How to configure props.conf for Splunk to recognize all timestamps in these logs?

Re: How to configure props.conf for Splunk to recognize all timestamps in these logs?