Getting Data In

Splunk_TA_Windows - script:installedapps timestamp issues?

daniel333
Builder

All, 

Thought I posted this before, but can't find it in my history. 

I am seeing alerts in my Splunk logs statin that the I am getting data from the future on my sourcetype  script:installedapps. It's default and unmodified from the Splunk_TA_Window standard.

From there I did notice that _indextime and _time were off a bit. 

When I look at props.conf provided by Splunk_TA_Windows it has no time stamp recognition. Is there a reason for this? Should I go ahead and add it or is there a trick for this I am missing? 

 

thanks

-Daniel 

Labels (1)
0 Karma

daniel333
Builder

So I went ahead and created a basic props.conf per my undertanding of best practice. 

 

My latency between time and indexed time was about -80second on this sourcetype. After adding the below props.conf to a local override I am now getting closer to 10 seconds. 

Didn't think props.conf would so dramatically impact a single sourcetype like that, but I guess it could? Either way no longer getting the data from the future error either. 

 

# props.conf
  
 [Script:InstalledApps]
 pulldown_type = true
 category = Windows
 description = List Installed Apps
 ### Index time
 # Input queue - event_breaker processed at the UF as well as IDX
 EVENT_BREAKER_ENABLE = true
 EVENT_BREAKER = ([\r\n]+)\d{4}\-\d{2}\-\d{2}\s+\d{1,2}:\d{2}:\d{2}.\d{3}
 NO_BINARY_CHECK = True
 CHARSET = UTF-8
  
 DATETIME_CONFIG=
 TIME_PREFIX= ^
 MAX_TIMESTAMP_LOOKAHEAD= 24
 TIME_FORMAT= %Y-%m-%d %H:%M:%S.%3Q
 MAX_DAYS_AGO = 1
 MAX_DAYS_HENCE = 2
  
 # Typing queue
 ANNOTATE_PUNCT = False
  
 # Indexing queue
 SEGMENTATION = indexing
  
 # Search time
 EVAL-data_classification = "Proprietary"
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...