Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Fernando_Sanch
Fernando_Sanch
Explorer
Member since:
12-01-2021
03-23-2022
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-01-2021 |
Activity Feed
- Posted Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 03-23-2022 06:54 AM
- Posted Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-02-2021 05:11 AM
- Posted Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-02-2021 05:04 AM
- Tagged Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-02-2021 05:04 AM
- Posted Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-02-2021 02:35 AM
- Posted Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-02-2021 02:14 AM
- Posted Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-02-2021 01:50 AM
- Posted Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-02-2021 12:19 AM
- Posted Re: Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-01-2021 03:50 AM
- Posted Troubleshooting TIME_FORMAT by not being applied on indexes? on Getting Data In. 12-01-2021 03:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
03-23-2022
06:54 AM
The issue was solved by adding a props.conf file.. which we didn't have! but thanks anyway 🙂
... View more
12-02-2021
05:11 AM
By the way, I just compared slowly my _time with your _time. Observe: your _time: 2021-12-02T09:10:00.000+2:00
my _time: 2021-02-12T11:10:09.000+01:00 My _time has a wrong month. Could that be the issue? Where is this _time being configured?
... View more
12-02-2021
05:04 AM
That's unfortunatelly not possible, since I am tied by the data protection policy. You are talking about a sourcetype, but what I am using in this stranza is a source::/path/to/file/license_*.txt for the files coming from this path. Doing a <splunk btool props source::/path/to/file/license_*.txt list --debug>, I can only see one props.conf path which is the same I am using, with the configuration you suggested before. Sorry, I can't show you more..
... View more
- Tags:
- Tha
12-02-2021
02:35 AM
Sorry for the confusion. I mean, and copy your text, "those other field where are date time values, then you must manually handle those as splunk automatically handle only _time field" My _time field looks exactly like the one you showed in the picture. It looks like this "2021-02-12T11:10:09.000+01:00" Here you can see that splunk is understanding that this log belongs to Feb. and not Dec. which is wrong.
... View more
12-02-2021
02:14 AM
Hi again, indeed, you are right, _time has the aspect you just showed. In my comment before, I meant the column "Time" which is being shown on the search.. sorry for that. I can tell that the props.conf I am using is actually being used, since yesterday I made a mistake in pupose to see if this was affecting the data inputs, and indeed, there was not data coming at all. As soon as I changed again the props.conf file, I was receiving data again. By the way, I am using the IDX instance. And yes, I restarted the splunk after manuall edition of props.conf, but there hasn't changed anything on the way splunk is picking mm and dd.
... View more
12-02-2021
01:50 AM
This hasn't changed a thing. I have noticed that in the web interface, _time is shown on the exact same orther as in the log _time: 02/12/2021 (meaning mm/dd/yyyy) --> splunk SH web interface log: 02/12/2021 (meaning dd/mm/yyyy) --> input log For some reason splunk uses the format mm/dd/yyyy, I don't really know if this is the issue. I am checking the datetime.xml file at the moment to see if I see something weird... Thanks for you support
... View more
12-02-2021
12:19 AM
This props.conf is in my indexer, exactly, it belongs to the application I'm showing on splunk web interface, it works normally, just not between the 1st and the dd==mm.. Sure here a sample of my data.: splunkuser@linuxSearchHead.org:: /here/the/path/to/the/file/license_usage.txt
02/12/2021 09:10:00,Application Test V1,X00X000XX00,XXXXX00,CurrentUser,XXX,0,2022-01-01 00:59:00,XXX,0,2022-03-01 00:59:00,0000000000000000,0,0
02/12/2021 09:10:00,Application Test V1,X00X000XX00,XXXXX00,CurrentUser,XXX,0,2022-01-01 00:59:00,XXX,0,2022-03-01 00:59:00,0000000000000000,0,0
02/12/2021 09:10:00,Application Test V1,X00X000XX00,XXXXX00,CurrentUser,XXX,0,2022-01-01 00:59:00,XXX,0,2022-03-01 00:59:00,0000000000000000,0,0
... View more
12-01-2021
03:50 AM
Hi isoutamo, thanks for your answer, I just edited props.conf to look like [source:://not/able/to/show/the/path/license_*.txt]
TIME_PREFIX=^
TIME_FORMAT=%d/%m/%Y %H:%M:%S
TIMESTAMP_FIELDS=Date I restarted splunk and checked with <splunk cmd btool props list --debug>. However the logs are still being saved on January the 12th
... View more
12-01-2021
03:26 AM
I know this topic has been discussed many times in this thread, but I have not found a case like mine so far. The index changes the day by the month and the month by the day from the 1st of each month until %d=%m. From 12/12 (for example) the data will be stored correctly in December.
The data I have in the log looks like this:
01/12/2021 12:10:04, ......
And the configuration I have in props.conf is as follows:
[source:://not/able/to/show/real/path/license_*.txt]
TIME_FORMAT=%d/%m/%Y %H:%M:%S
TIMESTAMP_FIELDS=Date
I have tried to analyze which props are taken into account with the command
splunk cmd btool props list --debug
The properties seem to be taken into account. In my case a TIME_PREFIX is not applicable either because there are no spaces or symbols at the beginning, I have tried everything.
Any suggestions? I ran out of ideas 😞
... View more
Labels
- Labels:
-
props.conf
-
time
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-23-2022
11:49 AM
|
