topic Re: File monitor in Splunk Search

File monitor

thierryazandegb — Wed, 17 Nov 2021 10:03:35 GMT

Hello,

We have a problem with the monitoring of a simple file with five fields.
The problem is on the date field that Splunk can't match as shown in the attached image.

Thanks in advance for your help.
Best regards.

Re: File monitor

thierryazandegb — Wed, 17 Nov 2021 10:06:25 GMT

Hello,
For all exchanges, please copy the following email address:
nourddine.moustakim@ratp.fr

Sincerely.

Re: File monitor

gcusello — Wed, 17 Nov 2021 10:08:53 GMT

hi @thierryazandegb,

the problem is in the sourcetype definition, in your props.conf you should have:

[your_sourcetype] TIME_PREFIX = ^ TIME_FORMAT = %d/%m/%Y;%H:%M:%S

Ciao.

Giuseppe