Victor, as long as you properly identify the timestamp in the log using the props.conf configurations when you index the file, Splunk will show that actual date of that event using whichever date you specify. https://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Propsconf TIME_PREFIX = MAX_TIMESTAMP_LOOKAHEAD = TIME_FORMAT = You can stitch together events using transaction command is the event has a unique sessionID or something similarly unique and that will roll the events into a nice time based view. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchfortransactions?r=searchtip ... View more

This? http://docs.splunk.com/Documentation/AddOns/released/Juniper/Setup o enable the Splunk Add-on for Juniper to collect data from your Juniper devices, you need to configure the Juniper devices to produce syslog output with an output format of default or splunk and push it to the data collection node of your Splunk platform installation, usually a universal forwarder. For syslog configuration instructions, consult the Juniper Networks documentation: Juniper OS (juniper:junos:idp and juniper:junos:firewall source types): http://www.juniper.net/techpubs/en_US/junos15.1/topics/example/syslog-messages-configuring-qfx-series.html Juniper Netscreen: http://kb.juniper.net/InfoCenter/index?page=content&id=KB4759 Juniper SSLVPN: Please search the Juniper Networks documentation. Juniper NSM (juniper:nsm and juniper:nsm:idp source types): http://kb.juniper.net/InfoCenter/index?page=content&id=KB11810 Juniper SRX: http://kb.juniper.net/InfoCenter/index?page=content&id=KB16502 ... View more

Are you leveraging indexed_extractions = JSON or using another method? http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Extractfieldsfromfileswithstructureddata ... View more

Check out indexed_extractions and leverage these new options to extract the structured data fields. NOTE: The indexed_extractions = CSV settings from props.conf are used on the FORWARDER. This method will always ensure that the fields are extracted correctly every time based on the header in the file. http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Extractfieldsfromfileswithstructureddata ... View more

No, you shouldn't be messing with anything in the system/defaults folder anyway. The app takes precedence. ... View more

Just move the props.conf that are on your indexers for that specific sourcetype to the same folder as the inputs.conf on your forwarder. Those settings for indexed_extractions are only for the forwarders. ... View more

The 6.5 release has new support for these capabilities it is also documented in the latest 6.X dashboard examples app: https://splunkbase.splunk.com/app/1603/ Notes from the app: New example "Search Refresh and Refresh Display" to leverage the new element refresh behavior support in dashboards (new feature in Splunk 6.5) ... View more

Are your props on the forwarder because if you are using indexed_extractions then the only place it should be is on the forwarder. ... View more

What happens if you just set: TIME_PREFIX = ^ TIME_FORMAT = %H:%M:%S,%3N MAX_TIMESTAMP_LOOKAHEAD = 12 Won't it just use the current year anyway? ... View more

Fantastic! Glad to help with a relatively unknown but great feature of Splunk! ... View more

As always, brilliant answers from sideview! ... View more

And maybe add a sample set of events to the post. ... View more

Need more detail. What does your inputs.conf, props.conf, and transforms.conf look like? ... View more

The Add-on for that app uses DELIMS with commas. So if you want it to work you would have to write out a proper REGEX to extract the fields properly. I loaded your example and saw the same issue. I thought since the referrer field is quoted that it should work, but alas, it did not. You could create a new field extract on _raw for that specific field if you like. Something like this: (?http.+?)" Or you could go through a laborious process and rewrite all the field extractions for the transforms.conf under the header of extract_threat. ... View more

But DATETIME_CONFIG=current will override the settings for timestamp configurations and will set all timestamps to the current time. I don't know your data so not sure if you need a custom DATETIME_CONFIG file. ... View more

Try this: TIME_PREFIX = .*?\[ TIME_FORMAT = %d/%b/%Y:%H:%M:%S -%z MAX_TIMESTAMP_LOOKAHEAD = 28 This is a good blog I put together if you have multiple time formats in the same log file and some events with nothing: http://blogs.splunk.com/2014/04/23/its-that-time-again For events with no dates at all, just set: DATETIME_CONFIG = current ... View more

PERFECT. Please upvote my answer and have a nice day. ... View more

Excellent! ... View more

Please accept and upvote the answer if you think it helped. ... View more

I updated my answer above with an image showing the data loaded into my local instance to give you context. ... View more

I wouldn't go this route. The newer approach is much faster, already extracts all field automagically, and speed up search and indexing. ... View more

Inputs is not a app, but a simple inputs.conf file that will also be on the forwarder. inputs.conf [monitor:///var/log/file.json] sourcetype=MYJSON props.conf [MYJSON] INDEXED_EXTRACTIONS=JSON TIMESTAMP_FIELDS = Timestamp If you are new, just do it all locally as a test on a locally installed Splunk instance, like your laptop, go through the UI to add data, select structured data, and ensure you are monitoring the file. Splunk will create the inputs and props for ya. ... View more