https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487699#M83494 <P>Yes, I am trying to collect events via HEC. Splunk is smartly formatting the timestamp, issue is that each exception form docker is getting posted as a separate event on a new line preceded by a containerid. My main doubt is that does props.conf on HF get picked up for HEC collector/event endpoint? I read on my other answers on this forum that /event endpoint doesn't pickup props and transforms processing.</P> Thu, 19 Sep 2019 14:16:26 GMT neha898 2019-09-19T14:16:26Z https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487696#M83491 <P>Why props.conf not getting picked up while ingesting data through HEC, /event endpoint?</P> Thu, 19 Sep 2019 03:56:11 GMT https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487696#M83491 neha898 2019-09-19T03:56:11Z https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487697#M83492 <P>Let me ask a clairifying question. Are you collecting event through a HEC input on a heavy fowarder, and it doesn't seem to apply your props config? Can you post a sample event and your props.conf?</P> Thu, 19 Sep 2019 13:02:29 GMT https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487697#M83492 xavierashe 2019-09-19T13:02:29Z https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487698#M83493 <P>Only raw gets sent through the parsing queue. Using event presumes you are properly formatting your event in JSON and the JSON extraction handles everything. This is expected behavior. </P> Thu, 19 Sep 2019 14:04:01 GMT https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487698#M83493 starcher 2019-09-19T14:04:01Z https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487699#M83494 <P>Yes, I am trying to collect events via HEC. Splunk is smartly formatting the timestamp, issue is that each exception form docker is getting posted as a separate event on a new line preceded by a containerid. My main doubt is that does props.conf on HF get picked up for HEC collector/event endpoint? I read on my other answers on this forum that /event endpoint doesn't pickup props and transforms processing.</P> Thu, 19 Sep 2019 14:16:26 GMT https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487699#M83494 neha898 2019-09-19T14:16:26Z https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487700#M83495 <P>I guess this is the confirmation I was looking for, so docker container logs should be ingested into SPlunk via the raw endpoint if we want to parse them at Splunk end.</P> Thu, 19 Sep 2019 14:18:31 GMT https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487700#M83495 neha898 2019-09-19T14:18:31Z https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487701#M83496 <P>keep in mind search time extractions are different than say even breaking and time stamping at the HF where HEC runs. so for the HF yes that is as I said and you'd need to be on raw.</P> Thu, 19 Sep 2019 15:51:38 GMT https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487701#M83496 starcher 2019-09-19T15:51:38Z https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487702#M83497 <P>Thanks a lot @starcher </P> Thu, 19 Sep 2019 17:58:25 GMT https://community.splunk.com/t5/Getting-Data-In/Why-props-conf-not-getting-picked-up-while-ingesting-data/m-p/487702#M83497 neha898 2019-09-19T17:58:25Z