I did some changes in the props.conf adding a stanza for time stamps
[mysourcetype]
DATETIME_CONFIG = CURRENT
But it still showing me the older time stamps. Please help to fix this issue.
Sathish
Where is your props.conf located? It should be on the server that is parsing the data, as Splunk sets the timestamp in the parsing phase. If you are using a Universal Forwarder to collect the data, then the props.conf belongs on the indexer. And yes, you will need to restart Splunk for changes to props.conf to take effect.
Second, if you use DATETIME_CONFIG = CURRENT, all the events in the file should be indexed using the current date and time - any timestamp in the file will be ignored. If that is not what you want, then you should look at @jkat54's advice. And a little sample data would be helpful.
Finally, are you sure that your data has the sourcetype "mysourcetype"?
Where is your props.conf located? It should be on the server that is parsing the data, as Splunk sets the timestamp in the parsing phase. If you are using a Universal Forwarder to collect the data, then the props.conf belongs on the indexer. And yes, you will need to restart Splunk for changes to props.conf to take effect.
Second, if you use DATETIME_CONFIG = CURRENT, all the events in the file should be indexed using the current date and time - any timestamp in the file will be ignored. If that is not what you want, then you should look at @jkat54's advice. And a little sample data would be helpful.
Finally, are you sure that your data has the sourcetype "mysourcetype"?
don't specify DATETIME_CONFIG and instead specify TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, and TIME_FORMAT.
Can you share sample data?
Well thanks for the reply guys I tried both the settings but TIme_PREFIX,MAX_TIMESTAMP_LOOKAHEAD is working thanks for the replys once again and thanks jkat54.
Did you make this change in props.conf on Indexer/Heavy forwarder? Did you restart your Splunk instance after making the change? Please note that this will only apply to any future event that will come to Splunk. Any event that has already indexed will not get updated.
Somesoni2:- yes I tried that but still seeing old dates. And deleted indexed logs and cleared fishbucket but still indexing time is not working.
How are you ingesting the data, using a forwarder (universal forwarder??) or from Splunk Web UI?