Problem with timestamp extraction and props.conf

[alferone]

I have the following props which works fine in the "Add Data" GUI and a test file of logs:

EVENT_BREAKER = ([\r\n]+)\<.+\>\w{2,4}\s\d{1,2}\s
EVENT_BREAKER_ENABLE = true
LINE_BREAKER = ([\r\n]+)\<.+\>\w{2,4}\s\d{1,2}\s
MAX_TIMESTAMP_LOOKAHEAD = 25
SHOULD_LINEMERGE = false
TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N
TIME_PREFIX = named\[.+\]\:\s
TRUNCATE = 99999
TZ = US/Eastern

I am trying to pull milliseconds from the log using the 2nd timestamp.

<30>Oct 30 11:31:39 172.1.1.1 named[18422]: 30-Oct-2024 11:31:39.731 client 1.1.1.1#1111: view 10: UDP: query: 27b9eb69be0574d621235140cd164f.test.com IN A response: NOERROR +EDV 27b9eb69be0236356140cd164f.test.com. 30 IN CNAME waw-test.net.; waw-mvp.test.net. 10 IN A 41.1.1.1; test.net. 10 IN A 1.1.1.1; test.net. 10 IN A 1.1.1.1; test.net. 10 IN A 1.1.1.1;

I have this loaded on the indexers and search heads.   But it is still pulling from the first timestamp.

A btool on the indexers shows this line that I have not configured.:

DATETIME_CONFIG = /etc/datetime.xml

Is this what is screwing me up?

Thank you!

[richgalloway]

Try setting

DATETIME_CONFIG =

in props.conf to disable the automatic timestamp extractor.

[alferone]

I'll take a look, and thank you!

[isoutamo]

Hi
Are you sure that indexers are the first full splunk instance from your source? If there is any like HF before indexers then you must add that props.conf there as it has effected only in 1st full splunk instance.
r. Ismo