Deployment Architecture

TIME_FORMAT on props.conf broke line breaking.

Communicator

Hello,
I have timestamps in the following format.

1383058343.661030

I added the following to my props.conf.

TIME_FORMAT = %s%6N

This was in a Splunk cluster. After the bundle was applied, the events stopped breaking like they normally do. Instead they started to be grouped together.

Questions:

  1. Is the time format correct for the time stamp?
  2. Do I need to add other configs on the peer side to allow for proper line breaking.
0 Karma
1 Solution

Ultra Champion

You are missing the dot.

TIME_FORMAT = %s.%6N

/K

View solution in original post

0 Karma

Ultra Champion

You are missing the dot.

TIME_FORMAT = %s.%6N

/K

View solution in original post

0 Karma

Communicator

I did indeed. Thanks!

0 Karma

Ultra Champion

And yes, this configuration is supposed to go to the indexers (or to a Heavy Forwarder - whichever comes first)

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

/K

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!