How to configure time format in props.conf to parse the original time in the log?

[rkeenan]

I've got logs that have time being sent to a syslog - the syslog is also putting a time on it to track when the logs hit the syslog.

I want Splunk to parse the original time in the log, and I've tried configuring the props.conf, but it seems that Splunk is still picking up the syslog prepended time. This is running on a HF and then being sent to Splunk cloud. Inputs sourcetype matches what I have in the props.conf.

I've run this through a local instance of Splunk to get the props.conf and it looks correct in the data preview - local is Windows, prod is Linux, but I wouldn't think that would matter for this.

Any suggestions on what to change would be greatly appreciated.

Example log line:

Apr 29 19:44:33 text SysLog[425355]: time="[29/Apr/2020:19:44:33 +0000]"

Current props:

[<sourcetype_name_here>]
SHOULD_LINEMERGE        = false
NO_BINARY_CHECK         = true
LINE_BREAKER            = ([\r\n]+)
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
TIME_PREFIX = time\=\"\[
TZ                      = GMT
MAX_TIMESTAMP_LOOKAHEAD = 27

[richgalloway]

You put those props on the HF, right?