I'm having some issues getting a feeds timestamp picked up properly. The date field comes in like this:
"date": "8/15/2019 10:55:16 AM". My props has this, which isn't working.
TZ = UTC TIME_FORMAT = %m/%d/%Y %I:%M:%S %p TIME_PREFIX = "date": "
You need this for props.conf:
TZ = UTC TIME_PREFIX = "date":\s+" TIME_FORMAT = %m/%d/%Y %I:%M:%S %p
Your settings are fine so it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using
_index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.
have you set the spec?
In this syntax, can be:
, the source type of an event.
host::, where is the host value for an event.
source::, where is the source value for an event.