Getting Data In

TIME_PREFIX configuration is not working

bhsakarchourasi
Path Finder

Hi All,

We are working in Splunk Cloud environment, I want to deploy custom the TIME_PREFIX configuration for one of the log source, we have tested the configuration in Splunk stand alone box, it works fine, we have deployed the same configuration on Splunk Cloud indexers and IDM node, but it's not working.

Below is my props configuration.

TIME_PREFIX = "time":\s*"

MAX_TIMESTAMP_LOOKAHEAD = 128 

sample value:

, "time": "2022-12-24T02:36:55.9183013Z",

My question is do I need to deploy this configuration on search heads as well.

 

Thanks,

Bhaskar    

Labels (4)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bhsakarchourasi.,

I'd use this TIME_PREFIX:

TIME_PREFIX = \"time\":\s*\"

Anyway, TIME_PREFIX should be on Forwarder, but I usually put it also on Search Head.

Ciao.

Giuseppe 

0 Karma

bhsakarchourasi
Path Finder

Hi, 

Thanks for the reply, that's correct, regex can be changed as per your suggestion, can you also provide a logical explanation for having this configuration on search head. I not able to figure this out as far as I understood time prefix should work if it's present in Indexer and HF.

 

Thanks,

Bhaskar 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...