props.conf not recursing all directories

[pljulien]

I'm trying to go down a line of directories to get the syslog files. The recursion works for year 2013. To make sure it works for other years copied 2013 files to 2012 and changed year in all in all files. When doing search with all time Splunk doesn't see 2012.

props.conf
[source:: HOSTS.../*.logfile
sourcetype = syslog
TIME_FORMAT = %m %d %H:%M:%D

Any assistance would be appreciated.

[mloven_splunk]

Are you trying to define an input with your [source...] statement? Because that's wrong.

In a props.conf, the [source...] statement is meant only to define what group of events to apply the props to.

You'd want to create an inputs.conf with something like this in it:

[monitor:///HOSTS.../*.logfile]
sourcetype = syslog

And then, if your syslog is properly formatted, you won't even need a props.conf stanza for that.

[mloven_splunk]

Ok.

Is your TIME_FORMAT correct? The standard TIME_FORMAT for the syslog sourcetype is:

TIME_FORMAT = %b %d %H:%M:%S

Which expects a month abbreviation (i.e. Jun, Nov, etc), then the day. Yours expects a timestamp like 12 09 16:27:00, which seems odd.

[pljulien]

Data is in a file. In inputs.conf I have:

[monitor:///opt/splunk/data/test/HOSTS/.../*.logfile]
index=test
sourcetype = syslog

When I didn't have the props.conf my data was coming in as the date of file, so created a props.conf file, fat-fingered above. It is:

[source:///opt/splunk/data/HOSTS/.../*.logfile]
sourcetype = syslog
TIME_FORMAT = %d %m %H:%M:%S

The directory structure is - .../HOSTS//year/month/day.logfile. The 2 files configured as noted, only getting data for 2013 and not 2012. Search set to all time. Any suggestions on changes to this would be appreciated.