Getting Data In

_time error

asncari
Engager

Good afternoon,
I have a very strange problem. I have a log with these 2 events:

01/02/2024 13:06:16 - SOLISP1 IP: 10.229.87.80 USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0
01/02/2024 13:00:54 - GGCARO3 IP: 10.229.87.80 USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

The date format in the event is dd/mm/yyyy
Well, splunk indexes one of them in January and another in February. We have tried editing the props file as follows:

[default]
TIME_PREFIX = ^
TIME_FORMAT = %d/%m/%Y %H:%M:%S

Anyone know what might be happening?

Labels (1)
0 Karma

asncari
Engager

I'll test it and tell you.

Thx Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @asncari,

probaly the options aren't applied to your sourcetype, please add them in a sourcetype, not to default, in props.conf:

[your_sourcetype]
TIME_PREFIX = ^
TIME_FORMAT = %d/%m/%Y %H:%M:%S

Ciao.

Giuseppe

0 Karma

asncari
Engager

Hi Giuseppe,

We have configured the props.conf with the sourcetype and the behavior is the same.

Thx Giuseppe.

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @asncari,

there's no reason for this behavior!

Please, make a last try: remove TIME_PREFIX, restart Splunk and try again.

Ciao.

Giuseppe

0 Karma

asncari
Engager

Hi, @gcusello 

Without the props file it is how we originally had it and that is why I added it.

I am going to open a case with Broadcom support because this doesn't make sense.

If we can solve it, I will write it here so that it can be of use to other people.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @asncari,

don't remove props.conf: leave it with 

[<your_sourcetype>]
TIME_FORMAT = %d/%m/%Y %H:%M:%S

Otherwise open a case to Splunk Support, sending them a diag.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...