Getting Data In

I can not set TIME_FORMAT for event in props.conf


Hello, splunk community.
I am new to splunk and already reviewed ton of info on the topic but I still can't get why I can't get splunk light to read _time from my event.
The event sent looks like this
{"event": {
"attributed_touch_type": "",
"attributed_touch_time": "",
"event_time": "2019-08-22 10:10:10",
"event_name": "install",
"event_value": "",
"event_revenue": "",
I configure my props.conf file here
... /opt/splunk/etc/system/local/
with the following params
TIME_PREFIX = \"event_time\" :\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S

I reset server several times and made sure data was indexed after reset. Any idea why splunk would not recognize my event_time for _time? Any help would be appreciated.
Thank you in advance.

0 Karma

Esteemed Legend

If your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

0 Karma


Hi noukash,
wher do you created this props.conf file?
You have to put it in the Indexer not in the Forwarder.

In addition it isn't a best practice to put it in /opt/splunk/etc/system/local/ but it's better to put it in a dedicated App.


Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...