Getting Data In
Highlighted

Splunk props.conf

Explorer

Hi,
My logs are not breaking correctly. Below is sample logs

16:40:13,732 INFO web Redeemed promotion=BI500POINTS for usaid=2300000032458812 channel=OMS amount=500.0 offerId=2536374313674604550 termId=null dateSk=7484 locationSk=550 isCancel=true tier=ROUGE
16:40:13,747 INFO web Redeemed promotion=ROUGE
WELCOMEKIT for usaid=2253998837903414 channel=atg amount=-0.0 offerId=3000000000000000001 termId=null dateSk=7484 locationSk=550 isCancel=false tier=ROUGE
16:40:13,748 INFO web Redeemed promotion=BI100POINTS for usaid=2253998837903414 channel=atg amount=-100.0 offerId=2536374313674604552 termId=null dateSk=7484 locationSk=550 isCancel=false tier=ROUGE
16:40:29,553 INFO web Redeemed promotion=BD
GIFT for usaid=2300000038257945 channel=atg amount=-0.0 offerId=2536374313674604551 termId=null dateSk=7484 locationSk=550 isCancel=false tier=BI
16:40:54,421 INFO web Redeemed promotion=BD
GIFT for usaid=2300000045716715 channel=atg amount=-0.0 offerId=2536374313674604551 termId=null dateSk=7484 locationSk=2492 isCancel=false tier=ROUGE
16:40:58,121 INFO web Redeemed promotion=VIB
WK for usa_id=2300000026110754 channel=pos amount=-0.0 offerId=2536374313674604555 termId=null dateSk=7484 locationSk=341 isCancel=false tier=BI

I tried
[web]
TIMEFORMAT=%T,%L
SHOULD
LINEMERGE=false

Tags (1)
0 Karma
Highlighted

Re: Splunk props.conf

Legend

Hi yanivdutt,
what are %T and %L?
try with

TIME_FORMAT=%H:%M:%S,%3N

I suggest to extract a sample from your logs and use the web guided log ingestion, so you can immediately test your props.

Bye.
Giuseppe

0 Karma