Getting Data In

TIME_PREFIX configuration is not working

bhsakarchourasi
Path Finder

Hi All,

We are working in Splunk Cloud environment, I want to deploy custom the TIME_PREFIX configuration for one of the log source, we have tested the configuration in Splunk stand alone box, it works fine, we have deployed the same configuration on Splunk Cloud indexers and IDM node, but it's not working.

Below is my props configuration.

TIME_PREFIX = "time":\s*"

MAX_TIMESTAMP_LOOKAHEAD = 128 

sample value:

, "time": "2022-12-24T02:36:55.9183013Z",

My question is do I need to deploy this configuration on search heads as well.

 

Thanks,

Bhaskar    

Labels (4)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bhsakarchourasi.,

I'd use this TIME_PREFIX:

TIME_PREFIX = \"time\":\s*\"

Anyway, TIME_PREFIX should be on Forwarder, but I usually put it also on Search Head.

Ciao.

Giuseppe 

0 Karma

bhsakarchourasi
Path Finder

Hi, 

Thanks for the reply, that's correct, regex can be changed as per your suggestion, can you also provide a logical explanation for having this configuration on search head. I not able to figure this out as far as I understood time prefix should work if it's present in Indexer and HF.

 

Thanks,

Bhaskar 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...