Getting Data In

Timestamp recognition

kcchu01
Explorer

I am trying to monitor the log file and index to Splunk with the following log format.

02/11/2020,16:09:02,test-xxxxx,DISCONNECT ....

The date format is in DD/MM/YYYY, I added the following stanza in the $SPLUNK/etc/system/local/props.conf of the indexer 

[testsourcetype]

TIME_FORMAT = %d/%m/%Y,%H:%M:%S

However the log still not able to be indexed to Splunk, are there anything I missed?

 

Thank you

 

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

Let me understand:

  • you updated your props.conf on Indexer,
  • then you restarted Splunk on Indexers,
  • your source file is changed in the meanwhile;

is this correct?

Check the last point because the props.conf is correct and located in the correct point.

But Splunk doesn't index twice a log.

For test, you could add to inputs.conf, in the stanza of the test input also 

crcSalt = <SOURCE>

in this way, changing the file name, you can index it more times.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

only one question: is there any Heavy Forwatders between the source and the Indexer?

If yes, you have to put this props.conf (also) on Heavy Forwarder.

then add to your props.conf 

TIME_PREFIX = ^

to be sure that Splunk takes the correct timestamp.

Another final question: what's the error you have?

Only one final hint. if a test installation it could be also ok, but usually it's a best practice not to put props.conf in $SPLUNK_HOME/etc/system/local, but it in an App or in Technical Add-On (TA).

Ciao.

Giuseppe

kcchu01
Explorer

Hi Giuseppe,

No heavy forwarder, just direct connect from UF to Indexer.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

what's the error you have?

ciao.

Giuseppe

0 Karma

kcchu01
Explorer

No new log found after modified the props.conf

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

Let me understand:

  • you updated your props.conf on Indexer,
  • then you restarted Splunk on Indexers,
  • your source file is changed in the meanwhile;

is this correct?

Check the last point because the props.conf is correct and located in the correct point.

But Splunk doesn't index twice a log.

For test, you could add to inputs.conf, in the stanza of the test input also 

crcSalt = <SOURCE>

in this way, changing the file name, you can index it more times.

Ciao.

Giuseppe

kcchu01
Explorer

Hi, the log can be indexed again after following your method.

 

Thanks a lot

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...