topic Re: TIME_FORMAT in props is not working in Getting Data In

TIME_FORMAT in props is not working

ankitarath2011 — Wed, 30 Sep 2020 01:50:46 GMT

I have configured the TIME_FORMAT in props.conf as mentioned below.

[mySourceType]
INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER = ,
SHOULD_LINEMERGE = false
HEADER_FIELD_LINE_NUMBER = 1
CHECK_FOR_HEADER = true
NO_BINARY_CHECK = true
disabled = false
initCrcLength = 2048
CHARSET = AUTO
KV_MODE = none
category = structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
pulldown_type = 1
SEDCMD-replacespace = s/ /_/g
TIMESTAMP_FIELDS = "TimeField"
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TZ = UTC

Monitoring CSV file in UF. This props is in indexer.

Example input data - 2019-08-13 07:15:00
2019-08-13 07:20:00

But after indexing _time is coming as 2019-08-13 07:00
2019-08-13 07:00

The Minute part is disappearing.

Please suggest some solution

Re: TIME_FORMAT in props is not working

somesoni2 — Wed, 21 Aug 2019 15:36:01 GMT

Put this settings in UF.

Re: TIME_FORMAT in props is not working

ankitarath2011 — Wed, 21 Aug 2019 15:52:20 GMT

Hey I tried again, it's working now. Thanks a lot. But , as per the documentation, time_format and all config should be there in Indexer and not in UF

Re: TIME_FORMAT in props is not working

wmyersas — Wed, 21 Aug 2019 17:23:16 GMT

What does your sample data look like? How many fields are in the CSV?

Re: TIME_FORMAT in props is not working

ankitarath2011 — Wed, 21 Aug 2019 17:28:58 GMT

Sample data I had mentioned in the question (Example input data). There are around 50 fields

Re: TIME_FORMAT in props is not working

wmyersas — Wed, 21 Aug 2019 18:50:31 GMT

Can you give a whole row and the headers?

Re: TIME_FORMAT in props is not working

ankitarath2011 — Thu, 22 Aug 2019 01:43:13 GMT

No, I can not do that. It's in secure environment

Re: TIME_FORMAT in props is not working

morethanyell — Thu, 22 Aug 2019 01:56:11 GMT

Try TIME_FORMAT = %F %X

Re: TIME_FORMAT in props is not working

ankitarath2011 — Tue, 03 Sep 2019 09:10:32 GMT

As per @somesoni2 suggestion, I put the props in UF and it is working fine now. Thanks.

Re: TIME_FORMAT in props is not working

dannyze — Mon, 27 Jul 2020 23:24:58 GMT

for reference,

I put the props in UF and it is working fine now. Thanks

Does this mean the directory of $SPLUNK_HOME/SplunkUniversalForwarder/default
or something else?