Change timestamp after initial configure in props.conf

[michael_vi]

Hi all,

I'm new to Splunk and couldn't find an answer to my problem in the docs.

I configured _time extraction from a raw data and put the needed config in props.conf in Heave Forwarder.

After that, I noticed that in some of the timestamps in the Splunk Server are not recognized correctly, therefore I need to correct a timestamps extraction.

After changing the parameters in props.conf, what are the next steps that I have to do in order to have a new change to appear in Splunk server.

Thanks

[michael_vi]

I did create an App in the UF and HF.

Updated the props.conf in HF and restarted the service. Did help

UF - inputs.conf

[monitor:///home/user/gdlogs/ccc_rawdata]
sourcetype = csv_custom
disabled = 0
index = credit

HF - props.conf

[csv_custom]
CHARSET=UTF-8
SHOULD_LINEMERGE=true
disabled=false
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N
TIME_PREFIX=^
REPORT-csv_custom = fields_extract

[venkatasri]

Hi, What you are doing is correct. props.conf shall be deployed to Heavy Forwarder if you have one in front of indexers. Can you paste your settings here and how are you forwarding data to Splunk is it  using UF?

Share sample data having timestamp in it and replace the sensitive information which is not to be shared here.

[aasabatini]

Hi Michael,

I suggest to create a small app (folder) and put inside your props and try to install (locate the app in the path $Splunk_home/etc/apps) on all splunk instance.

Indexer

Search Head 

HF

Regards

Alessandro