Getting Data In

I can not set TIME_FORMAT for event in props.conf


Hello, splunk community.
I am new to splunk and already reviewed ton of info on the topic but I still can't get why I can't get splunk light to read _time from my event.
The event sent looks like this
{"event": {
"attributed_touch_type": "",
"attributed_touch_time": "",
"event_time": "2019-08-22 10:10:10",
"event_name": "install",
"event_value": "",
"event_revenue": "",
I configure my props.conf file here
... /opt/splunk/etc/system/local/
with the following params
TIME_PREFIX = \"event_time\" :\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S

I reset server several times and made sure data was indexed after reset. Any idea why splunk would not recognize my event_time for _time? Any help would be appreciated.
Thank you in advance.

0 Karma

Esteemed Legend

If your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

0 Karma


Hi noukash,
wher do you created this props.conf file?
You have to put it in the Indexer not in the Forwarder.

In addition it isn't a best practice to put it in /opt/splunk/etc/system/local/ but it's better to put it in a dedicated App.


Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW! Every day the list of sources Admins are responsible for gets bigger and bigger, often making ...