PROPS configuration for Source Data with Field Names and Values Stored in Text File

SplunkDash — Tue, 28 Sep 2021 16:12:43 GMT

Hello,

I have some issues writing a PROPS configuration file for the following source data stored in text file. I also used TIMESTAMP_FIELDS= timeStamp there, to have field values under field names. But, it's not working. My PROPS configuration and a sample event are given below. Any help will be highly appreciated. Thank you so much.

[ __auto__learned__ ]

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)

TIMESTAMP_FIELDS=timeStamp

TIME_PREFIX =^\{\"timeStamp\"\:\"

TIME_FORMAT=%Y-%m-%d %H:%M:%S

MAX_TIMESTAMP_LOOKAHEAD=29

{"timeStamp":"2021-06-21 14:53:56 EDT","appName":"OSD","userType":"FILTER","StatCd":null,"Amt":null,"errorMsg":"","eventId":"APP_ENTRY","eventType":"VIEW","fileSourceCd":null,"ipAddr":"11.212.41.151","mftCd":null,"outputCd":null,"planNum":null,"reasonCd":null,"returnCd":"00","sessionId":"XWGMwkncVD0m60OQBOahu8s/qG1c=","Period":null,"cat":"234207501","Type":null,"userId":"cdabea740a-g9a0-408f-a6a7-5ae70c689e6d","vsardata":{"uri":"/osd/rest/accountSummary","host":"appsa.rup.afsiep.net","ipAddress":"11.212.41.151","Id":"AXSabea753c-d9a0-408f-a6a7-5ae70c689e6d","requestId":"as58510cd-0459-614b7bc4-1afdd700-0bf875285d76","referer":https://saada.ruer.egsiep.net/osd/,"responseStatus":0}}

Re: PROPS configuration for Source Data with Field Names and Values Stored in Text File

richgalloway — Wed, 29 Sep 2021 00:30:47 GMT

It would help if you explained what you mean by "it's not working".

The TIMESTAMP_FIELDS setting is for use with INDEXED_EXTRACTIONS. Try these settings

[ __auto__learned__ ] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) TIME_PREFIX = \{"timeStamp":" TIME_FORMAT = %Y-%m-%d %H:%M:%S %Z MAX_TIMESTAMP_LOOKAHEAD = 29

topic Re: PROPS configuration for Source Data with Field Names and Values Stored in Text File in Splunk Search

PROPS configuration for Source Data with Field Names and Values Stored in Text File

Re: PROPS configuration for Source Data with Field Names and Values Stored in Text File