I got a requirement to Upload Logs to Splunk
Out of 5 Hosts 3 are Linux and other 2 are windows
The Logs getting picked by Splunk but for Linux but for windows Unable to see Logs from 1st to 9th of every month
The timestamp for windows server is 1/09/2022, 2/09/2022 and so on till 9/09/2022
%d in props need date to be two digit but here it is just one digit hence the logs are not getting picked
so tried below props for windows with %e:
We apply props using sourcetype in general as it was not working tried props with source but still same issue
By the way in our infrastructure props are kept in heavy forwarder and are applied at index time
Can anyone help on this please?
I think that splunk is recognised this as an en_US time format and there the first number is month and second one is day. For that reason it is setting wrong _time to your events.
You should try to add correct time stamp recognition for those nodes.
Add into props.conf
DATETIME_CONFIG = TIME_PREFIX = <what else your timestamp prefix is e.g. ^ if start of line> TIME_FORMAT = %e/%m/%Y %H:%M:%S (or what ever your time format is)
Above should works.
The easiest way to check it, is to take some raw events to file and then import it to your test instance with "Add Data -> Upload" that file and add above definition. Just play with those settings as long it works.
Of course you could give sample data/event to us and we can help you with it.
Thanks for the Response @isoutamo
The first number in the timestamp 1/09/2022, 2/09/2022 is day and the second number is month
shall I use DATETIME_CONFIG as NONE or CURRENT?
and DATETIME_CONFIG=NONE Does exactly what, if you can explain this that would be great!
Yes the 1st number is day, but as in en_US locale it is month, splunk quite often take the wrong assumption for it.
Just leave DATETIME_CONFIG = . Then it just undefined it from its default value.