Why is Splunk not respecting the TIME_FORMAT in props.conf?

[gsmi]

I have a log message which starts with a time stamp. Splunk is automatically extracting this and indexing the messages with the wrong date and time.

For example the following message would have been indexed with the date of 11th July 2018 17:22.27 instead of 7th of Nov 2018 16:22.27 UTC

07/11/2018 17:22:27.837 Log_Level=WARN ...............

I have added a time zone and TIME_FORMAT regex in the props.conf of my app to try an correct this but for some reason Splunk is not respecting it.

my props.conf looks like

[IDSAlert]
EXTRACT-message = ^(?:[^=\n]*=){10}(?P<message>.+)
DATETIME_CONFIG =
NO_BINARY_CHECK = true
TIME_FORMAT = %d/%m/%Y %H:%M:%S.%3N
TZ = UTC
category = Custom
disabled = false

[richgalloway · Accepted solution]

It may help to add the following lines to the [IDSAlert] stanza:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 23

Be sure to restart the indexers and heavy forwarders after editing props.conf or the changes will not be respected.

[gsmi]

I had the props.conf in an app on the search head, moving to the heavy forwarders and restarting them worked.