Getting Data In
Highlighted

I can not set TIME_FORMAT for event in props.conf

Explorer

Hello, splunk community.
I am new to splunk and already reviewed ton of info on the topic but I still can't get why I can't get splunk light to read time from my event.
The event sent looks like this
{"event": {
"attributed
touchtype": "",
"attributed
touchtime": "",
"event
time": "2019-08-22 10:10:10",
"eventname": "install",
"event
value": "",
"eventrevenue": "",
}}
I configure my props.conf file here
... /opt/splunk/etc/system/local/
with the following params
[appsflyer]
ATETIME
CONFIG = NONE
TIMEPREFIX = \"eventtime\" :\"
MAXTIMESTAMPLOOKAHEAD = 9999
TIME_FORMAT = %Y-%m-%d %H:%M:%S

I reset server several times and made sure data was indexed after reset. Any idea why splunk would not recognize my event_time for _time? Any help would be appreciated.
Thank you in advance.

0 Karma
Highlighted

Re: I can not set TIME_FORMAT for event in props.conf

Legend

Hi noukash,
wher do you created this props.conf file?
You have to put it in the Indexer not in the Forwarder.

In addition it isn't a best practice to put it in /opt/splunk/etc/system/local/ but it's better to put it in a dedicated App.

Bye.
Giuseppe

Highlighted

Re: I can not set TIME_FORMAT for event in props.conf

Esteemed Legend

If your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier), restart all Splunk instances there, send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.