What values to be updated in the props conf file ?

[ethanthomas]

My logfile is like below,

"timestamp": "2021-03-22 22:37:35". 

Can someone tell me how to edit the props file correctly ? My current props file doesent have the time parameters listed .

DATETIME_CONFIG =

KV_MODE =json

# INDEXED EXTRACTIONS =json

NO_BINAY_CHECK= true

Appreciate the help on this  . Shoud I give TIME_PREFIX= timestamp ? What else parameters required ?

[venkatasri]

Hi @ethanthomas 

props.conf can be deployed on Splunk UF, HF , SH and indexer.  What you are referring to seems to be closed to parsing layer which can be either deployed on HF or indexer as timestamp extraction only happens there and get assigned to _time when you search events in SH.

Assuming you are going to use the props conf during parsing,

[your_sourcetype_name]
TIME_PREFIX=\"timestamp\":\s+\"
TIME_FORMAT=%Y-%m-%d %H:%M:%S

NOTE: There are additional fields can be used together depends on data, KV_MODE  works on SH, INDEXED_EXTRACTIONS works on UF.

You can refer - Configure timestamp recognition - Splunk Documentation

props.conf - props.conf - Splunk Documentation

TIME_FORMAT - Date and time format variables - Splunk Documentation

---------------------------------------------------

An upvote would be appreciated if it helps!