- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Hi I'm trying to get the logs in the indexing time...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did some changes in the props.conf adding a stanza for time stamps
[mysourcetype]
DATETIME_CONFIG = CURRENT
But it still showing me the older time stamps. Please help to fix this issue.
Sathish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where is your props.conf located? It should be on the server that is parsing the data, as Splunk sets the timestamp in the parsing phase. If you are using a Universal Forwarder to collect the data, then the props.conf belongs on the indexer. And yes, you will need to restart Splunk for changes to props.conf to take effect.
Second, if you use DATETIME_CONFIG = CURRENT, all the events in the file should be indexed using the current date and time - any timestamp in the file will be ignored. If that is not what you want, then you should look at @jkat54's advice. And a little sample data would be helpful.
Finally, are you sure that your data has the sourcetype "mysourcetype"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where is your props.conf located? It should be on the server that is parsing the data, as Splunk sets the timestamp in the parsing phase. If you are using a Universal Forwarder to collect the data, then the props.conf belongs on the indexer. And yes, you will need to restart Splunk for changes to props.conf to take effect.
Second, if you use DATETIME_CONFIG = CURRENT, all the events in the file should be indexed using the current date and time - any timestamp in the file will be ignored. If that is not what you want, then you should look at @jkat54's advice. And a little sample data would be helpful.
Finally, are you sure that your data has the sourcetype "mysourcetype"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
don't specify DATETIME_CONFIG and instead specify TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD, and TIME_FORMAT.
Can you share sample data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well thanks for the reply guys I tried both the settings but TIme_PREFIX,MAX_TIMESTAMP_LOOKAHEAD is working thanks for the replys once again and thanks jkat54.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you make this change in props.conf on Indexer/Heavy forwarder? Did you restart your Splunk instance after making the change? Please note that this will only apply to any future event that will come to Splunk. Any event that has already indexed will not get updated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Somesoni2:- yes I tried that but still seeing old dates. And deleted indexed logs and cleared fishbucket but still indexing time is not working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How are you ingesting the data, using a forwarder (universal forwarder??) or from Splunk Web UI?
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
