Hi,
I have a problem with the Splunk timestamp.
I know that when you have a problem with timestamp, you can modify this 2 ways:
1. Add data and modify the timestamp during the steps of adding manually data on Splunk.
2. Modify the props.conf
The problem :
As we can see, on my log, the real timestamp is not the same compared to the timestamp recognized by Splunk.
For the First Way:
1.1 Adding Data manually and modify the timestamp steps by steps :
As we can see, Splunk recognizes the time, but not the date correctly, so I will modify the timestamp with the parameter on the left ( prefix and format)
1.2 So I will add the correct parameter:
--> I add the format and prefix, Splunk seem to recognize this correctly
(but the prefix is strange because it works also when I write d{2}; or d{1}; or d*; ... )
At the final step, when I apply this ... nothing works after when I want to search something or when i just want to look the logs event. Nothing happens and I see the message that Splunk is waiting for queued job to start.
For the Second Way
edit props.conf
There is so many props.conf, so to be sure, which one do I have to modify?
I guess this one: Splunk/etc/apps/search/local ?
And what do I have to add exactly?
I guess it is TIME_PREFIX = ... and TIME_FORMAT= ...
Then after adding these parameters with the values, is there something else to modify to complete the configuration? Because even with this way, nothing happens and that doesn't work for me.
I missed something maybe, but I don't know what...
Kind Regards
Steve
... View more