https://community.splunk.com/t5/Getting-Data-In/Tuning-my-linux-secure-sourcetype/m-p/467983#M80580 <P>Ah! Lowercase 'm' I see it now. </P> Wed, 18 Dec 2019 23:54:40 GMT daniel333 2019-12-18T23:54:40Z https://community.splunk.com/t5/Getting-Data-In/Tuning-my-linux-secure-sourcetype/m-p/467982#M80579 <P>All, </P> <P>I am seeing parsing queue slow downs when large sets of linux_secure data comes in. After talking with support we decided that the default timestamp of "auto" was a bad idea for us. So I am rewriting the props.conf file for linux_secure</P> <PRE><CODE>[linux_secure2] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD = 27 NO_BINARY_CHECK = true REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%dT%H:%m:%S.%q TIME_PREFIX = ^ TZ = GMT category = Operating System description = Format for the /var/log/secure file containing all security related messages on a Linux machine disabled = false pulldown_type = true </CODE></PRE> <P>How ever when I run this, all my events come stamped at 4:00. Any idea where I went wrong? </P> <P>Here is an example log</P> <PRE><CODE>2019-12-17T23:01:36.259901+00:00 ssomehost.somedomain.local sudo: ambari : TTY=unknown ; PWD=/var/lib/ambari-agent ; USER=root ; ENV=PATH=/usr/sbin:/sbin:/usr/lib/ambari-server/*:/usr/hdp/current/hadoop-client/bin:/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/chef/bin:/var/lib/ambari-agent ; COMMAND=/usr/bin/test -f /disk11 </CODE></PRE> Wed, 30 Sep 2020 03:24:54 GMT https://community.splunk.com/t5/Getting-Data-In/Tuning-my-linux-secure-sourcetype/m-p/467982#M80579 daniel333 2020-09-30T03:24:54Z https://community.splunk.com/t5/Getting-Data-In/Tuning-my-linux-secure-sourcetype/m-p/467983#M80580 <P>Ah! Lowercase 'm' I see it now. </P> Wed, 18 Dec 2019 23:54:40 GMT https://community.splunk.com/t5/Getting-Data-In/Tuning-my-linux-secure-sourcetype/m-p/467983#M80580 daniel333 2019-12-18T23:54:40Z