Splunk Apache %T %D - Splunk Community

Getting Data In

Hi

I have a plunk server and it reads the logs from our web servers. Weve recelty added on the end the %T %D time flag. Splunk just shows this as other.

Ive tried a few things to add it to the transforms file and props file but nothing works. How can I add these flags so they are seen correctly?

Matt

Hi,

Can you post the contents of props.conf and transforms.conf here ? That will help in debugging the issue.

Regards,
Amit Saxena

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...