Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

what would be the perfect props.conf for this event

abhishekkalokhe
Explorer

Date=2020-02-10|StrtTime=09:56:08|EndTime=09:56:08|Duration=7|EvntType=MSG|UUID=

props that i am using :

TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d
MAX_TIMESTAMP_LOOKAHEAD = 40
LINE_BREAKER = Date=\d+-\d+-\d+
TRUNCATE = 9999
SHOULD_LINEMERGE = false
CHARSET=UTF-8
disabled=false

can i use TIME_FORMAT = %Y-%m-%d OR do i have to use TIME_FORMAT = %Y-%m-%d|StrtTime=%H:%M:%S

0 Karma
1 Solution

nickhills
Ultra Champion

Set the prefix to exclude "date=": TIME_PREFIX = ^Date=
Set the lookahead so it only catches the first time: MAX_TIMESTAMP_LOOKAHEAD = 28
Your timeformat example should (i think) work: TIME_FORMAT = %Y-%m-%d|StrtTime=%H:%M:%S

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Set the prefix to exclude "date=": TIME_PREFIX = ^Date=
Set the lookahead so it only catches the first time: MAX_TIMESTAMP_LOOKAHEAD = 28
Your timeformat example should (i think) work: TIME_FORMAT = %Y-%m-%d|StrtTime=%H:%M:%S

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!