Hello,
On a monoinstance Splunk, I'd like to ingest some simple JSON data :
{
GDH: 2021-07-08 16:54:00.617222
action: )reV[viZpy)4noHQFhs7;)*!wHlRaY3mo4R(o6,
dossier: FR668CORG2021078979348557
id: 4000000
ident: 267987
ip: 10.226.689.32
org: PN
service: 3647971
telephone: +33672108802
}
I'd like to use only KV_mode, without indexed_extractions = json.
Here's my sourcetype :
[data_kvm_json]
DATETIME_CONFIG =
KV_MODE =
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = GDH
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6N
category = Structured
description = sourcetype - kv_mode extraction
disabled = false
pulldown_type = true
NO_BINARY_CHECK = true
Here's the result :
The event is indexed at the time of the ingestion, not the event date wich is is GDH field.
I have several sourcetypes on another environnement (clustered IDX + SH), where this positionned in props.conf on indexer cluster works fine.
Is this a consequence of the architecture being only a mono-instance ?
What did I miss ?
Thanks,
Regards,
Eglantine
Hi,
no luck.. same results in the UI (tried with "" and not) :
Thanks for the suggestion anyway.
Regards,
Ema
Try adding TIME_PREFIX = GDH: to props.conf