Splunk Search

splunk props timestamp issue


I have a CSV file with the below data, trying to push to Splunk.

Example - 

Thu JUN 24  15:27:52 +08 2021,name1,address1,Thu  JUN25  12:27:52  +08 2021,Active

Thu JUN 24  15:27:52 +08 2021,name2,address2,Thu JUN 25  03:65:52  +08 2021,Active

Thu JUN 24  15:27:52 +08 2021,name3,address3,Thu JUN 25  05:15:52  +08 2021,Active

Thu JUN 24  15:27:52 +08 2021,name4,address4,Thu MAY26  06:25:52  +08 2021,Active

Thu JUN 24  15:27:52 +08 2021,name5,address5,Thu MAY26  06:15:52  +08 2021,Active

Thu JUN 24  15:27:52 +08 2021,name6,address6,Thu JAN14  07:15:52  +08 2021,Active

props setting

in props using fourth field as timestamp.






by using the above props I can able to push only the latest date data, other events are missing in Splunk.

for example, I can see only JUN25th data. remaining events are missing.

Can someone explain, what might be the cause.


0 Karma


I would try looking at timestamp extraction configuration. Specifically MAX_DAYS_AGO and MAX_DIFF_SECS_AGO in props.conf

It could be the case that Splunk thinks that your events are far in the past and therefore not indexing them.

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...