topic Re: Change timestamp after initial configure in props.conf in Getting Data In

Change timestamp after initial configure in props.conf

michael_vi — Thu, 18 Feb 2021 08:41:57 GMT

Hi all,

I'm new to Splunk and couldn't find an answer to my problem in the docs.

I configured _time extraction from a raw data and put the needed config in props.conf in Heave Forwarder.

After that, I noticed that in some of the timestamps in the Splunk Server are not recognized correctly, therefore I need to correct a timestamps extraction.

After changing the parameters in props.conf, what are the next steps that I have to do in order to have a new change to appear in Splunk server.

Thanks

Re: Change timestamp after initial configure in props.conf

aasabatini — Thu, 18 Feb 2021 08:59:05 GMT

Hi Michael,

I suggest to create a small app (folder) and put inside your props and try to install (locate the app in the path $Splunk_home/etc/apps) on all splunk instance.

Indexer

Search Head

Regards

Alessandro

Re: Change timestamp after initial configure in props.conf

venkatasri — Fri, 19 Feb 2021 01:01:01 GMT

Hi, What you are doing is correct. props.conf shall be deployed to Heavy Forwarder if you have one in front of indexers. Can you paste your settings here and how are you forwarding data to Splunk is it using UF?

Share sample data having timestamp in it and replace the sensitive information which is not to be shared here.

Re: Change timestamp after initial configure in props.conf

michael_vi — Mon, 22 Feb 2021 12:39:27 GMT

I did create an App in the UF and HF.

Updated the props.conf in HF and restarted the service. Did help

UF - inputs.conf

[monitor:///home/user/gdlogs/ccc_rawdata]
sourcetype = csv_custom
disabled = 0
index = credit

HF - props.conf

[csv_custom]
CHARSET=UTF-8
SHOULD_LINEMERGE=true
disabled=false
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N
TIME_PREFIX=^
REPORT-csv_custom = fields_extract