Getting Data In

Timestamp recognition

kcchu01
Explorer

I am trying to monitor the log file and index to Splunk with the following log format.

02/11/2020,16:09:02,test-xxxxx,DISCONNECT ....

The date format is in DD/MM/YYYY, I added the following stanza in the $SPLUNK/etc/system/local/props.conf of the indexer 

[testsourcetype]

TIME_FORMAT = %d/%m/%Y,%H:%M:%S

However the log still not able to be indexed to Splunk, are there anything I missed?

 

Thank you

 

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

Let me understand:

  • you updated your props.conf on Indexer,
  • then you restarted Splunk on Indexers,
  • your source file is changed in the meanwhile;

is this correct?

Check the last point because the props.conf is correct and located in the correct point.

But Splunk doesn't index twice a log.

For test, you could add to inputs.conf, in the stanza of the test input also 

crcSalt = <SOURCE>

in this way, changing the file name, you can index it more times.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

only one question: is there any Heavy Forwatders between the source and the Indexer?

If yes, you have to put this props.conf (also) on Heavy Forwarder.

then add to your props.conf 

TIME_PREFIX = ^

to be sure that Splunk takes the correct timestamp.

Another final question: what's the error you have?

Only one final hint. if a test installation it could be also ok, but usually it's a best practice not to put props.conf in $SPLUNK_HOME/etc/system/local, but it in an App or in Technical Add-On (TA).

Ciao.

Giuseppe

kcchu01
Explorer

Hi Giuseppe,

No heavy forwarder, just direct connect from UF to Indexer.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

what's the error you have?

ciao.

Giuseppe

0 Karma

kcchu01
Explorer

No new log found after modified the props.conf

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

Let me understand:

  • you updated your props.conf on Indexer,
  • then you restarted Splunk on Indexers,
  • your source file is changed in the meanwhile;

is this correct?

Check the last point because the props.conf is correct and located in the correct point.

But Splunk doesn't index twice a log.

For test, you could add to inputs.conf, in the stanza of the test input also 

crcSalt = <SOURCE>

in this way, changing the file name, you can index it more times.

Ciao.

Giuseppe

kcchu01
Explorer

Hi, the log can be indexed again after following your method.

 

Thanks a lot

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...