PROPS Configuration file for data sources with timestamp more than 10 years

SplunkDash — Mon, 24 Jan 2022 22:43:21 GMT

Hello,

I am getting some error messages within my PROPS Configuration file to parse timestamp data. The sample file/event, my props configuration, and error message are giving below. Any help will be highly appreciated. Thank you so much:

Sample Event:

<?xml version="1.0" encoding="ISO99991"?>

<EVENTID>NAMEE</EVENTID> <EVENTTYPE>SEARCH</EVENTTYPE>

<NAMECTRL>TESTPWE</NAMECTRL>

</MDWDATA>

PROPS:

[ __auto__learned__ ]

SHOULD_LINEMERGE=true

LINE_BREAKER=([\r\n]*)<MODTRANSAUDTRL>

TIME_PREFIX=<TIMESTAMP>

TIME_FORMAT=%Y%m%d%H%M%S

MAX_TIMESTAMP_LOOKAHEAD=14

TRUNCATE=1000

ERROR Message:

Re: PROPS Configuration file for data sources with timestamp more than 10 years

PickleRick — Mon, 24 Jan 2022 23:13:39 GMT

The error should be quite self-explanatory. And the proposed solution as well.

Your date is from 2011, which is more than default 5.5 years ago limit.

Adjust your MAX_DAYS_AGO setting.

topic Re: PROPS Configuration file for data sources with timestamp more than 10 years in Splunk Search

PROPS Configuration file for data sources with timestamp more than 10 years

Re: PROPS Configuration file for data sources with timestamp more than 10 years