Getting Data In

Time_PREFIX for Props.conf with unstructured text file

SplunkDash
Motivator

Hi There,

Here is a segment of my sample data . Data is in text format. My Props.conf file has also been provided below. I have some issues to figure out what I would write in TIME_PREFIX for my PROPS.Conf file (please see below). Any help will be highly appreciated, thank you.

malekmo_0-1624595074903.png

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)

CHARSET=UTF-8

TIME_PREFIX=

TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N

MAX_TIMESTAMP_LOOKAHEAD=18

 

Thank you and Regards,

Labels (2)
Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @SplunkDash 

I do not find a possibility to set TIME_PREFIX for your case i would rather leave the timestamp detection to Splunk, splunk is able to detect if you do not set any TIME* related conf. 

SplunkDash
Motivator

Then what would be my PROPS.CONF file........

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@SplunkDash Test with following and see how timestamp is being set by Splunk. Additionally you can set TZ which is a timezone if your event timezone is different from indexer.

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)

 ----

An upvote would be appreciated and accept solution if it helps!

SplunkDash
Motivator

Thank you so much, appreciated!

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@SplunkDash please accept solution if it helps! 

venkatasri
SplunkTrust
SplunkTrust

Hi @SplunkDash 

Its bit tricky to find from screenshot only prefix of time you have is space which is \s,  you can try something as follows, you shall change other params as well. If your text event having pre-determined spaces before timestamp just use the exact number.. something like if you have fixed 10 spaces \s{10}.

TIME_PREFIX = \s{6,}

MAX_TIMESTAMP_LOOKAHEAD = 23

TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3Q

----

An upvote would be appreciated and accept solution if it helps!

0 Karma

SplunkDash
Motivator

Hi venkatasri,

Thank you for your quick response, appreciated. Unfortunately, it's not a fixed space...it varies from 2 to 20+.... please see another segment of sample data.

 

malekmo_0-1624599332997.png

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...