Why is props.conf current date not working?

[yohhpark]

test_id": "CHICKEN-0123456",
"last_test_date": "2023-09-04 12:34:00"

with such above file and todays date 09/25/2023

once it is monitored by the splunk, I cannot search this data with the 'current' date or even current time; 15 or 60mintues.

instead it tends to read the dates off of the file which is the 'last test date' = 09/24/2023 therefore from the search I have to put either on that day or 1day to find the data.

Props.conf currently set as 

DATETIME_CONFIG = CURRENT

I want the file to be 'read' today if it was uploaded today. (or 15 min if it was uploaded within 15min) NOT going off of the date in the file.

Gurus hop in plesae.

[PickleRick]

Ok. First things first - where and how do you ingest the files and where do you have the props.conf with the DATETIME_CONFIG setting? And are you sure it is being active?

[yohhpark]

forwarder is forwarding (ex) /var/log/test.txt

and the file IS test.txt

and it is active because I can see the files from the search, except the dates are not feeding.

props.conf is seating on the /etc/apps/test/local/props.conf

[PickleRick]

OK. But on which component did you put this props.conf file? On the UF? Then it's not the proper place for it. UF does not do parsing (except for indexed extractions but it's not the case I suppose) and DATETIME_CONFIG is a setting regarding parsing stage. So put it onto your indexer(s) or intermediate HF(s) if you have them.

Also - did you configure DATETIME_CONFIG for the proper sourcetype?

[Manojbh_splunk]

what is the timezone your server is in.

current_time takes current system time

[yohhpark]

it's EST.

also that is not the problem. it's the date also.

docuemtn name is 09042023_test.txt

and inside it has something like

ID= 101010

processed_date=09/03/2023

and today's date is 09/05/2023

but when the forwarder forwards, it takes the date inside of the document resulting the search has to go 2 days back to find the data

[yohhpark]

anything new you've found? still couldn't solved the issue.

[Manojbh_splunk]

Can you share your props.conf file.

i think you are forcing splunk to take _time as processedtime in logs

[yohhpark]

it's really nothing to share honestly.

[test]

DATETIME_CONFIG = current