Archive
Highlighted

Hi I'm trying to get the logs in the indexing time but some reason it still indexing the file was created.

New Member

I did some changes in the props.conf adding a stanza for time stamps
[mysourcetype]
DATETIME_CONFIG = CURRENT

But it still showing me the older time stamps. Please help to fix this issue.

Sathish

Tags (1)
0 Karma
Highlighted

Re: Hi I'm trying to get the logs in the indexing time but some reason it still indexing the file was created.

SplunkTrust
SplunkTrust

Did you make this change in props.conf on Indexer/Heavy forwarder? Did you restart your Splunk instance after making the change? Please note that this will only apply to any future event that will come to Splunk. Any event that has already indexed will not get updated.

Highlighted

Re: Hi I'm trying to get the logs in the indexing time but some reason it still indexing the file was created.

New Member

Somesoni2:- yes I tried that but still seeing old dates. And deleted indexed logs and cleared fishbucket but still indexing time is not working.

0 Karma
Highlighted

Re: Hi I'm trying to get the logs in the indexing time but some reason it still indexing the file was created.

SplunkTrust
SplunkTrust

How are you ingesting the data, using a forwarder (universal forwarder??) or from Splunk Web UI?

0 Karma
Highlighted

Re: Hi I'm trying to get the logs in the indexing time but some reason it still indexing the file was created.

SplunkTrust
SplunkTrust

don't specify DATETIMECONFIG and instead specify TIMEPREFIX, MAXTIMESTAMPLOOKAHEAD, and TIME_FORMAT.

Can you share sample data?

Highlighted

Re: Hi I'm trying to get the logs in the indexing time but some reason it still indexing the file was created.

New Member

Well thanks for the reply guys I tried both the settings but TImePREFIX,MAXTIMESTAMP_LOOKAHEAD is working thanks for the replys once again and thanks jkat54.

0 Karma
Highlighted

Re: Hi I'm trying to get the logs in the indexing time but some reason it still indexing the file was created.

Legend

Where is your props.conf located? It should be on the server that is parsing the data, as Splunk sets the timestamp in the parsing phase. If you are using a Universal Forwarder to collect the data, then the props.conf belongs on the indexer. And yes, you will need to restart Splunk for changes to props.conf to take effect.

Second, if you use DATETIME_CONFIG = CURRENT, all the events in the file should be indexed using the current date and time - any timestamp in the file will be ignored. If that is not what you want, then you should look at @jkat54's advice. And a little sample data would be helpful.

Finally, are you sure that your data has the sourcetype "mysourcetype"?

View solution in original post

0 Karma