File monitor

[thierryazandegb]

Hello,

We have a problem with the monitoring of a simple file with five fields.
The problem is on the date field that Splunk can't match as shown in the attached image.

Thanks in advance for your help.
Best regards.

[gcusello]

hi @thierryazandegb,

the problem is in the sourcetype definition, in your props.conf you should have:

[your_sourcetype]
TIME_PREFIX = ^
TIME_FORMAT = %d/%m/%Y;%H:%M:%S

Ciao.

Giuseppe

[thierryazandegb]

Hello,
For all exchanges, please copy the following email address:
nourddine.moustakim@ratp.fr

Sincerely.