Getting Data In

I can not set TIME_FORMAT for event in props.conf

noukash
Explorer

Hello, splunk community.
I am new to splunk and already reviewed ton of info on the topic but I still can't get why I can't get splunk light to read _time from my event.
The event sent looks like this
{"event": {
"attributed_touch_type": "",
"attributed_touch_time": "",
"event_time": "2019-08-22 10:10:10",
"event_name": "install",
"event_value": "",
"event_revenue": "",
}}
I configure my props.conf file here
... /opt/splunk/etc/system/local/
with the following params
[appsflyer]
ATETIME_CONFIG = NONE
TIME_PREFIX = \"event_time\" :\"
MAX_TIMESTAMP_LOOKAHEAD = 9999
TIME_FORMAT = %Y-%m-%d %H:%M:%S

I reset server several times and made sure data was indexed after reset. Any idea why splunk would not recognize my event_time for _time? Any help would be appreciated.
Thank you in advance.

0 Karma

woodcock
Esteemed Legend

If your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi noukash,
wher do you created this props.conf file?
You have to put it in the Indexer not in the Forwarder.

In addition it isn't a best practice to put it in /opt/splunk/etc/system/local/ but it's better to put it in a dedicated App.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...