Getting Data In

What values to be updated in the props conf file ?


My logfile is like below,

"timestamp": "2021-03-22 22:37:35". 

Can someone tell me how to edit the props file correctly ? My current props file doesent have the time parameters listed .


KV_MODE =json



Appreciate the help on this  . Shoud I give TIME_PREFIX= timestamp ? What else parameters required ?

Labels (1)
Tags (3)
0 Karma


Hi @ethanthomas 

props.conf can be deployed on Splunk UF, HF , SH and indexer.  What you are referring to seems to be closed to parsing layer which can be either deployed on HF or indexer as timestamp extraction only happens there and get assigned to _time when you search events in SH.

Assuming you are going to use the props conf during parsing,

TIME_FORMAT=%Y-%m-%d %H:%M:%S

NOTE: There are additional fields can be used together depends on data, KV_MODE  works on SH, INDEXED_EXTRACTIONS works on UF.

You can refer - Configure timestamp recognition - Splunk Documentation

props.conf - props.conf - Splunk Documentation

TIME_FORMAT - Date and time format variables - Splunk Documentation


An upvote would be appreciated if it helps!

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...