Getting Data In
Highlighted

How to ignore the timestamp or any time value provided in the logs and use current time of the servers forwarding data instead?

Path Finder

I am indexing a log file which doesn't have a timestamp, but have a few events that have completion time (how much time it took to complete kind of time difference). Splunk is taking this time as timestamp which ultimately is causing wrong timestamp assignment.

Event is something like below:

[check:INFO][abc.sh] abc.sh Total Time: 0:10:47

In Splunk it is shown as

14/12/2016 10:47:00.000 [check:INFO][abc.sh] abc.sh Total Time: 0:10:47

However, this 10:47 is not the timestamp. For a few events, it is working fine, but not for each event.

I've tried putting the props.conf below on the Search head. I also want to break each line as an event, but it is also not working 😞

[mysourcetype]
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Custom
disabled = false
pulldown_type = true
LINE_BREAKER=([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 0

My forwarders are in EST and Splunk server time is GMT.

0 Karma
Highlighted

Re: How to ignore the timestamp or any time value provided in the logs and use current time of the servers forwarding data instead?

SplunkTrust
SplunkTrust

The above configuration should be kept in Indexers OR heavy forwarders. Also, it'll fix this for new data only, old historical data would still be wrong.

View solution in original post

Highlighted

Re: How to ignore the timestamp or any time value provided in the logs and use current time of the servers forwarding data instead?

Path Finder

Thanks for suggestion. Deployed above configuration in indexers and it worked. 🙂

0 Karma