Getting Data In

Splunk - Assigning custom time

gunnist
Explorer

I want my time to be the "Date" property in the following json:

{ "Level": "ERROR", "Date": "2021-08-20 17:21:53.6355", "Logger":.... }

I created a props.conf here: ...\Splunk\etc\system\local with:

TIME_PREFIX = "Date":\s"
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N

I then restarted splunk...but it's not working. Any idea what I'm missing?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The current settings say Splunk should find a 4-digit year immediately following '"Date":', but that's not the case. Try TIME_PREFIX = "Date":\s". There's no need to escape the quotation marks.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...