TIME_PREFIX configuration is not working

[bhsakarchourasi]

Hi All,

We are working in Splunk Cloud environment, I want to deploy custom the TIME_PREFIX configuration for one of the log source, we have tested the configuration in Splunk stand alone box, it works fine, we have deployed the same configuration on Splunk Cloud indexers and IDM node, but it's not working.

Below is my props configuration.

TIME_PREFIX = "time":\s*"

MAX_TIMESTAMP_LOOKAHEAD = 128 

sample value:

, "time": "2022-12-24T02:36:55.9183013Z",

My question is do I need to deploy this configuration on search heads as well.

Thanks,

Bhaskar    

[gcusello]

Hi @bhsakarchourasi.,

I'd use this TIME_PREFIX:

TIME_PREFIX = \"time\":\s*\"

Anyway, TIME_PREFIX should be on Forwarder, but I usually put it also on Search Head.

Ciao.

Giuseppe 

[bhsakarchourasi]

Hi, 

Thanks for the reply, that's correct, regex can be changed as per your suggestion, can you also provide a logical explanation for having this configuration on search head. I not able to figure this out as far as I understood time prefix should work if it's present in Indexer and HF.

Thanks,

Bhaskar