https://community.splunk.com/t5/Getting-Data-In/access-log-index/m-p/391575#M69980 <P>Hi,</P> <P>I am planning to index one of the access.log file. which has data like below first line header and next two lines two example data. </P> <PRE><CODE>"time_stamp" "auth_user" src_ip status_code "req_line" "categories" "rep_level" "media_type" bytes_to_client bytes_from_client "user_agent" "virus_name" "block_res" "application_name" [29/Mar/2019:06:04:57 +0530] "" 176.6.60.56 403 "GET <A href="http://abcd.com/HTTP/1.1&quot;" target="test_blank">http://abcd.com/HTTP/1.1"</A>; "Software/Hardware" "Minimal Risk" "" 8811 237 "Microsoft-CryptoAPI/6.1" "" "0" "" [29/Mar/2019:06:04:57 +0530] "asharma072315" 176.6.50.55 200 "POST <A href="https://obdefw.com/HTTP/1.1&quot;" target="test_blank">https://obdefw.com/HTTP/1.1"</A>; "Web Mail" "Minimal Risk" "" 1208 7687 "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.9126; Pro)" "" "0" "" </CODE></PRE> <P>But while trying to inidex it splunk says time format is incorrect/invalid. </P> <P>Can you please suggest the props.conf and transforms.conf for this log file. </P> <P>in my inputs.conf i have mentioned something like this:<BR /> [monitor:///appname/lookups/*]<BR /> disabled = 1<BR /> source_type = accesslog<BR /> index = accesslog</P> Fri, 05 Apr 2019 08:49:13 GMT surekhasplunk 2019-04-05T08:49:13Z https://community.splunk.com/t5/Getting-Data-In/access-log-index/m-p/391575#M69980 <P>Hi,</P> <P>I am planning to index one of the access.log file. which has data like below first line header and next two lines two example data. </P> <PRE><CODE>"time_stamp" "auth_user" src_ip status_code "req_line" "categories" "rep_level" "media_type" bytes_to_client bytes_from_client "user_agent" "virus_name" "block_res" "application_name" [29/Mar/2019:06:04:57 +0530] "" 176.6.60.56 403 "GET <A href="http://abcd.com/HTTP/1.1&quot;" target="test_blank">http://abcd.com/HTTP/1.1"</A>; "Software/Hardware" "Minimal Risk" "" 8811 237 "Microsoft-CryptoAPI/6.1" "" "0" "" [29/Mar/2019:06:04:57 +0530] "asharma072315" 176.6.50.55 200 "POST <A href="https://obdefw.com/HTTP/1.1&quot;" target="test_blank">https://obdefw.com/HTTP/1.1"</A>; "Web Mail" "Minimal Risk" "" 1208 7687 "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.9126; Pro)" "" "0" "" </CODE></PRE> <P>But while trying to inidex it splunk says time format is incorrect/invalid. </P> <P>Can you please suggest the props.conf and transforms.conf for this log file. </P> <P>in my inputs.conf i have mentioned something like this:<BR /> [monitor:///appname/lookups/*]<BR /> disabled = 1<BR /> source_type = accesslog<BR /> index = accesslog</P> Fri, 05 Apr 2019 08:49:13 GMT https://community.splunk.com/t5/Getting-Data-In/access-log-index/m-p/391575#M69980 surekhasplunk 2019-04-05T08:49:13Z