topic Re: Please write Props for the following data because time format not working in Getting Data In

Please write Props for the following data because time format not working

muez — Tue, 21 Jan 2020 03:14:49 GMT

Below is data :

30,01/21/20,11:56:24,DNS Update Request,ip,xxx,,,0,6,,,,,,,,,0
11,01/21/20,11:56:24,Renew,ip,xxx,4889E71C9936,,3085275568,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
36,01/21/20,11:56:24,Packet dropped because of Client ID hash mismatch or standby server.,ip,,105BADA1EB57,,0,6,,,,,,,,,0

Please write props conf for this type of data.
According to splunk, from new year, splunk has stopped recognising two digit time stamps automatically.

Re: Please write Props for the following data because time format not working

gcusello — Tue, 21 Jan 2020 07:59:35 GMT

Hi @muez,
try this props.conf

[your_sourcetype]
TIME_PREFIX = \d\d,
TIME_FORMAT = %m/%d/%y,%H:%M:%S

If you haven't Splunk 8.0.1, remember to update datetime.xml following the Splunk Support instructions ( https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020?elqTrackId=29cfe97d93df4472a4746e2296a937f9&elq=ed2de69db30c40acb3fc83ff4397b1ae&elqaid=25340&elqat=1&elqCampaignId=12135 ).

Ciao.
Giuseppe

Re: Please write Props for the following data because time format not working

muez — Tue, 21 Jan 2020 08:42:42 GMT

props is not working, i think I have to follow Splunk Instructions. Thanks

Re: Please write Props for the following data because time format not working

gcusello — Tue, 21 Jan 2020 09:12:20 GMT

Hi @muez,
where do you used the props.conf? it must be on Indexer or (when present) on Heavy Forwarder not on Universal Forwarder and then you have to restart Splunk.

Ciao.
Giuseppe

Re: Please write Props for the following data because time format not working

muez — Tue, 21 Jan 2020 10:04:24 GMT

We have heavy forwarders where we write props everytime. It doesnt work 😞

Re: Please write Props for the following data because time format not working

gcusello — Tue, 21 Jan 2020 10:11:21 GMT

Hi @muez,
your data seems to be structured data, do they come from a csv?
In this case, put props.conf on Universal Forwarder that ingests csv.

Ciao.
Giuseppe