Props Conf File

[SplunkDash]

How would I write the props config file for following events, any help will be highly appreciated, thank you!

Thu, 01 Jul 2021 00:20:04 -0400|system|flush_vulns|INFO|-1|Removing old data in Repository

Thu, 01 Jul 2021 00:20:04 -0400|system|flush_vulns|INFO|-1|Successful removal of old  data in Repository

Thu, 01 Jul 2021 00:20:05 -0400|system|flush_vulns|INFO|-1|Removing old data in Repository

Thu, 01 Jul 2021 00:20:05 -0400|system|flush_vulns|INFO|-1|Successful removal of old data in Repository

[manjunathmeti · Accepted solution]

hi @SplunkDash,

You have pipe-separated data, you can also try  INDEXED_EXTRACTIONS.

[sourcetype]
INDEXED_EXTRACTIONS = PSV
FIELD_NAMES = timestamp,context,type,log_level,code,message
TIMESTAMP_FIELDS = timestamp
SHOULD_LINEMERGE = false

[SplunkDash]

..yes working as expected.....thank you so much, truly appreciated!!!

[SplunkDash]

.... yes working as expected. Thank you, truly  appreciated.

[manjunathmeti]

Please accept it as a solution, so it will help others with similar issue.

[isoutamo]

Hi

can you describe what you want to get by props (e.g. some fields defined or drop events or ....)?

r. Ismo

[SplunkDash]

Thank you so much. I stuck writing my TIME_PREFIX and TIME_FORMAT in Props Configuration file for those events . Thank you again.

[isoutamo]

Can you post your current version?

[SplunkDash]

7.3.3

[isoutamo]

I mean your props.conf and transforms.conf (if you have also it).

[SplunkDash]

Why we need the version of it...? .....anyways, I solved that issue (see below). Thank you so much, appreciated!!!

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)

NO_BINARY_CHECK=true

TIME_PREFIX=\,+\s

TIME_FORMAT=%d %b %Y %H:%M:%S %z

MAX_TIMESTAMP_LOOKAHEAD=26