Splunk Dev

_time format in props config file

k_harini
Communicator

I have time_submitted in this format - 10-08-2017 16:20:40 AEST, so in props file I gave in this format
TIMESTAMP_FIELDS = created_on
TIME_FORMAT = %d-%m-%Y %H:%M:%S %Z

Is this correct? when indexing data it takes index time instead of created_on.. Experts, kindly help

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi k_harini,
your TIME_FORMAT seems to be correct, anyway the easiest way to test it is to dowload an example of your logs and then use the web interface Add data function (Settings -- Add data -- Add local data] to immediately test your TIME_FORMAT.

Only an additional information: where do you put your props.con containing TIME_FORMAT?
It must be on the Indexer (with the only exceprion of csv files) not on the forwarder.

Bye.
Giuseppe

0 Karma

dshakespeare_sp
Splunk Employee
Splunk Employee

Your TIME_FORMAT looks correct. TIMESTAMP_FIELDS = created_on suggests that this is a csv file is this correct?
It would be useful to see the output from 'splunk cmd btool props list --debug' for the source / source type and a sample of the datafile including the header. The props.conf needs to be placed where the data is parsed (usually Indexer or HWF) or on the UF if you are using INDEXED_EXTRACTIONS = csv

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...