How to edit my TIME_PREFIX in props.conf to properly extract the timestamp from my sample event?

[joshualarkins]

-health_checkin_date: 2016-10-30T09:45:28.824Z

That is the line from a JSON event being sent into my Splunk instance via TCP syslog. It's being put into an index in an app I made, so I added the following the props.conf of that app:

[company_product]
TRUNCATE=0
TIME_PREFIX=\"-health_checkin_date\":\s
TIME_FORMAT=%Y-%m-%dT%T.%3N%Z
CHARSET=AUTO
KV_MODE=NONE
INDEXED_EXTRACTIONS=JSON

This stanza matches what is set in the TCP receiver as the custom sourcetype for this port, but the timestamp isn't being properly extracted. I'm intentionally prefixing the field with a hyphen so Splunk will find it quickly in the event. Am I editing the wrong props.conf?

[lguinn2 · Accepted solution]

Yes, I believe that your time prefix is incorrect. A regular expression does not need to be placed in quotation marks. Try this:

TIME_PREFIX=-health_checkin_date:\s

[joshualarkins]

[company_product]
TRUNCATE=0
TIME_PREFIX=\"-health_checkin_date\":\"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TZ=UTC
CHARSET=AUTO
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON

ended up solving it right after I posted this. I think it might be extra important to view the raw log and build the time prefix based on this, rather than attempt to guess based on the way Splunk shows JSON data all prettified.

[joshualarkins]

... Is my TIME_PREFIX incorrect?