Splunk deployment

[Vladislav]

My splunk web service is cannot recognize my source type in props.conf file when I try to add data. Here is my props.conf file's content:

[Test9]
TIME_PREFIX=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s\-\s\d{5}\s+
TIME_FORMAT = %m/%d/%Y %k:%M
MAX_TIMESTAMP_LOOKAHEAD = 15
LINE_BREAKER = ([\r\n]+)\d+\s+\"\$EIT\,
SHOULD_LINEMERGE = false
TRUNCATE = 99999

splunk.png

my props.conf file path is: C:\Program Files\Splunk\etc\apps\test\local

[richgalloway]

What message lurks beneath the yellow triangles?

There are a few concerns:

1) The event timestamps may be too old to extract properly

2) MAX_TIMESTAMP_LOOKAHEAD of 15 is too short for times after 9:59

3) The sourcetype name is "Test9" in props.conf, but "test9" is selected in the wizard.  Sourcetypes are case-sensitive by default.