You appear to be working with a few misconceptions. TIME_FORMAT is just a format string. Functions are not processed, but are considered part of the time string. TIME_PREFIX should be the text that comes before the timestamp. It is also a literal string. TIMESTAMP_FIELDS doesn't apply since you are not using INDEXED_EXTRACTIONS . Try these settings: description=JavaScript Object Notation format. For more information, visit http://json.org/ disabled=false pulldown_type=true LINE_BREAKER=([\r\n]+) TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3NZ TIME_PREFIX="DATE" : " TRUNCATE=999999 ... View more

Limits for controlling disk space in Splunk can be changed The relevant stanza and parameter of interest in server.conf is: [diskUsage] minFreeSpace = <num> For more details, check here: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setlimitsondiskusage This can be changed on any Splunk installations as explained on the online documentation: for all installations, including forwarders, you must have a minimum of 5GB of hard disk space available in addition to the space required for any indexes. The default is 5000 (mb) and this value can be changed as explained before. For more details, check here: http://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements#Recommended_hardware ... View more