PROPS configuration for Source Data with Field Names and Values Stored in Text File

[SplunkDash]

Hello,

I have some issues writing a PROPS configuration file for the following  source data stored in text file. I  also used TIMESTAMP_FIELDS= timeStamp there, to have field values under field names.  But, it's not working. My PROPS configuration and a sample event are given below.  Any help will be highly appreciated. Thank you so much. 

[ __auto__learned__ ]

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)

TIMESTAMP_FIELDS=timeStamp

TIME_PREFIX =^\{\"timeStamp\"\:\"

TIME_FORMAT=%Y-%m-%d %H:%M:%S

MAX_TIMESTAMP_LOOKAHEAD=29

{"timeStamp":"2021-06-21 14:53:56 EDT","appName":"OSD","userType":"FILTER","StatCd":null,"Amt":null,"errorMsg":"","eventId":"APP_ENTRY","eventType":"VIEW","fileSourceCd":null,"ipAddr":"11.212.41.151","mftCd":null,"outputCd":null,"planNum":null,"reasonCd":null,"returnCd":"00","sessionId":"XWGMwkncVD0m60OQBOahu8s/qG1c=","Period":null,"cat":"234207501","Type":null,"userId":"cdabea740a-g9a0-408f-a6a7-5ae70c689e6d","vsardata":{"uri":"/osd/rest/accountSummary","host":"appsa.rup.afsiep.net","ipAddress":"11.212.41.151","Id":"AXSabea753c-d9a0-408f-a6a7-5ae70c689e6d","requestId":"as58510cd-0459-614b7bc4-1afdd700-0bf875285d76","referer":https://saada.ruer.egsiep.net/osd/,"responseStatus":0}}

[richgalloway · Accepted solution]

It would help if you explained what you mean by "it's not working".

The TIMESTAMP_FIELDS setting is for use with INDEXED_EXTRACTIONS.  Try these settings

[ __auto__learned__ ]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = \{"timeStamp":"
TIME_FORMAT = %Y-%m-%d %H:%M:%S %Z
MAX_TIMESTAMP_LOOKAHEAD = 29