Getting Data In

TIME_PREFIX configuration is not working

bhsakarchourasi
Path Finder

Hi All,

We are working in Splunk Cloud environment, I want to deploy custom the TIME_PREFIX configuration for one of the log source, we have tested the configuration in Splunk stand alone box, it works fine, we have deployed the same configuration on Splunk Cloud indexers and IDM node, but it's not working.

Below is my props configuration.

TIME_PREFIX = "time":\s*"

MAX_TIMESTAMP_LOOKAHEAD = 128 

sample value:

, "time": "2022-12-24T02:36:55.9183013Z",

My question is do I need to deploy this configuration on search heads as well.

 

Thanks,

Bhaskar    

Labels (4)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bhsakarchourasi.,

I'd use this TIME_PREFIX:

TIME_PREFIX = \"time\":\s*\"

Anyway, TIME_PREFIX should be on Forwarder, but I usually put it also on Search Head.

Ciao.

Giuseppe 

0 Karma

bhsakarchourasi
Path Finder

Hi, 

Thanks for the reply, that's correct, regex can be changed as per your suggestion, can you also provide a logical explanation for having this configuration on search head. I not able to figure this out as far as I understood time prefix should work if it's present in Indexer and HF.

 

Thanks,

Bhaskar 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...