You don't need extra Time setting on props.conf Splunk can extract timestamps [ your sourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=AUTO TRANSFORMS-your_setting = your_setting ... View more

You're welcome. If you think my answer helped you an upvote would be appreciated 🙂  ... View more

You're welcome! An upvote to the answer would be appreciated 🙂  ... View more

Did you do what I suggested in my answer? See the links below. You don't need debugging, you need informational, and you need to add "log" or "log-input" to the Access Control Entries (ACEs) ... View more

Hi Dave, Thank your for your reply! I was trying to use _time event. It was small mistake, i didnt notice that at all. I forget to remove the comment 😞 now its working fine. ... View more

The Splunk App is fully supported on Linux: You can also install the app on a Splunk Enterprise instance that runs on other 64-bit operating systems such as Linux. In this scenario, the app displays Windows data coming from external Windows sources. We use this scenario for years.. ... View more

Are you listening on udp/514? Check Settings > Data Inputs > UDP for a port 514. If it is not there, add it, and then check the results. For a great tutorial on using syslog with Splunk, check out this article. http://www.georgestarcher.com/splunk-success-with-syslog/ ... View more