Getting Data In

Why is TIME_FORMAT not working in props.conf?

sheloaha
Path Finder

My events have the following timestamp at the beginning of each line:

[2016-05-18T18:41:51.440-04:00] 

In props.conf, I set the following but it is not working:

NO_BINARY_CHECK=true
disabled=false
TIME_PREFIX=^[
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TZ=America/New_York

Any ideas on why this is not working?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Change these:

TIME_PREFIX = ^\[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

Also leave out the TZ line because the event has the timezone already (you just need to specify that it is there).

View solution in original post

0 Karma

woodcock
Esteemed Legend

Change these:

TIME_PREFIX = ^\[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

Also leave out the TZ line because the event has the timezone already (you just need to specify that it is there).

0 Karma

sheloaha
Path Finder

Thank you! That made the difference.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>