Getting Data In

Time extraction using props.conf

Glom
New Member

We have some events coming in to Splunk that show as following:

time="09/10/2024 11:41:15"
URL="[Redacted String]"
Name="[Redacted String]"
Issuer="[Redacted String]"
Issued="27/10/2023 13:27:22"
Expires="26/10/2025 12:27:22"


Splunk is using ingest time instead of the time field. In props.conf for this sourcetype I have the following:

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = time=
TIME_FORMAT = "%d/%m/%Y %H:%M:%S"
CHARSET = UTF-8
KV_MODE = none
DISABLED = false

However the time isn't being extracted properly, what do I need to change / add?

Thanks.

Labels (1)
0 Karma

dural_yyz
Motivator

TIME_PREFIX is a regex match and they can get touchy sometimes.  I would force the = and the " to be escaped so: TIME_PREFIX = time\=\".  Then I would take advantage of the MAX_TIMESTAMP_LOOKAHEAD, although it should be inherited from the default I always like to put it in my app when I have multiple timestamps in the raw data.

0 Karma

Glom
New Member

Hi I modified the props.conf as recommended and no change, time is still being taken as ingest time:

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = time\=\"
TIME_FORMAT = "%d/%m/%Y %H:%M:%S"
MAX_TIMESTAMP_LOOKAHEAD = 27
CHARSET = UTF-8
KV_MODE = none
DISABLED = false

Any other ideas?

0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

Please try to remove the " (double quotes) from the TIME_FORMAT.

TIME_FORMAT=%d/%m/%Y %H:%M:%S

 

If this isn't working checkout the btool on this source/host/sourcetype for any DATETIME_CONFIG setting on your props.conf.

Hope this helps.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...