I'm having a time parsing issue that I don't know how to fix and am looking for some help.
My inputs on the syslog looks like this:
[monitor]index = *no_appending_timestamp = truehost_segment = 5disabled = false
My Props for this source type is configured by a TA. But the problem I'm having in the logs were from changes in our syslog system.
The new log looks like Dec 14 08:50:19 bxxm-itb.net.xxx.xxx 1,2021/12/14 08:50:18,
How do I configure props to tell splunk to ignore the first timestamp, skip the host fqdn and then parse the second time?
you have to add to your props.conf the following options:
TIME_PREFIX = ,
TIME_FORMAT = %Y/%m/%d %H:%M:%S
View solution in original post
That did it @gcusello , thank you.