How to configure our expected timestamp format in props.conf?

splunker9999 — Wed, 12 Oct 2016 18:51:54 GMT

Hi,

We need to format our time stamps using props.conf, since our events do not have date/month/year to our logs, it has only %H:%M:%S. we need to append %Y/%M/%D to every event.

This is for our logs format looks like.

14:55:55,229 INFO [stdout] (ServerService THread Pool--64)ss_debug(1:)Sending secure hello message
14:55:55,232 INFO [stdout] (ServerService THread Pool--64)ss_debug(1:) server created new session

Can you please provide props configuration for this?

Thanks

Re: How to configure our expected timestamp format in props.conf?

dmaislin_splunk — Wed, 12 Oct 2016 21:19:07 GMT

What happens if you just set:

TIME_PREFIX = ^
TIME_FORMAT = %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 12

Won't it just use the current year anyway?

topic How to configure our expected timestamp format in props.conf? in Getting Data In

How to configure our expected timestamp format in props.conf?

Re: How to configure our expected timestamp format in props.conf?