My logfile is like below,
"timestamp": "2021-03-22 22:37:35".
Can someone tell me how to edit the props file correctly ? My current props file doesent have the time parameters listed .
DATETIME_CONFIG =
KV_MODE =json
# INDEXED EXTRACTIONS =json
NO_BINAY_CHECK= true
Appreciate the help on this . Shoud I give TIME_PREFIX= timestamp ? What else parameters required ?
Hi @ethanthomas
props.conf can be deployed on Splunk UF, HF , SH and indexer. What you are referring to seems to be closed to parsing layer which can be either deployed on HF or indexer as timestamp extraction only happens there and get assigned to _time when you search events in SH.
Assuming you are going to use the props conf during parsing,
[your_sourcetype_name]
TIME_PREFIX=\"timestamp\":\s+\"
TIME_FORMAT=%Y-%m-%d %H:%M:%S
NOTE: There are additional fields can be used together depends on data, KV_MODE works on SH, INDEXED_EXTRACTIONS works on UF.
You can refer - Configure timestamp recognition - Splunk Documentation
props.conf - props.conf - Splunk Documentation
TIME_FORMAT - Date and time format variables - Splunk Documentation
---------------------------------------------------
An upvote would be appreciated if it helps!