Getting Data In

Why is TIME_FORMAT not working in props.conf?

sheloaha
Path Finder

My events have the following timestamp at the beginning of each line:

[2016-05-18T18:41:51.440-04:00] 

In props.conf, I set the following but it is not working:

NO_BINARY_CHECK=true
disabled=false
TIME_PREFIX=^[
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TZ=America/New_York

Any ideas on why this is not working?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Change these:

TIME_PREFIX = ^\[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

Also leave out the TZ line because the event has the timezone already (you just need to specify that it is there).

View solution in original post

0 Karma

woodcock
Esteemed Legend

Change these:

TIME_PREFIX = ^\[
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

Also leave out the TZ line because the event has the timezone already (you just need to specify that it is there).

0 Karma

sheloaha
Path Finder

Thank you! That made the difference.

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...