Why am I unable to see Logs first week of every month?

[blbr123]

Hello All

I got a requirement to Upload Logs to Splunk

Out of 5 Hosts 3 are Linux and other 2 are windows

The Logs getting picked by Splunk but for Linux but for windows Unable to see Logs from 1st to 9th of every month

The timestamp for windows server is 1/09/2022, 2/09/2022 and so on till 9/09/2022

%d in props need date to be two digit but here it is just one digit hence the logs are not getting picked

so tried below props for windows with %e:

TIME_FORMAT=%e/%m/%Y %H:%M:%S

We apply props using sourcetype in general as it was not working tried props with source but still same issue

By the way in our infrastructure props are kept in heavy forwarder and are applied at index time

Can anyone help on this please?

[isoutamo]

Hi

I think that splunk is recognised this as an en_US time format and there the first number is month and second one is day. For that reason it is setting wrong _time to your events.

You should try to add correct time stamp recognition for those nodes.

Add into props.conf

DATETIME_CONFIG =
TIME_PREFIX = <what else your timestamp prefix is e.g. ^ if start of line>
TIME_FORMAT = %e/%m/%Y %H:%M:%S (or what ever your time format is)

Above should works.

The easiest way to check it, is to take some raw events to file and then import it to your test instance with "Add Data -> Upload" that file and add above definition. Just play with those settings as long it works.

Of course you could give sample data/event to us and we can help you with it.

r. Ismo 

[blbr123]

Thanks for the Response @isoutamo 

The first number in the timestamp 1/09/2022, 2/09/2022 is day and the second number is month

shall I use DATETIME_CONFIG as NONE or CURRENT?

and DATETIME_CONFIG=NONE Does exactly what, if you can explain this that would be great!

🙂

[isoutamo]

Yes the 1st number is day, but as in en_US locale it is month, splunk quite often take the wrong assumption for it. 
Just leave DATETIME_CONFIG = . Then it just undefined it from its default value.

[blbr123]

@isoutamo I have tried the configs but still same issue  

Please find the props 

[blbr123]

In the internal logs it gives error " parsing configuration stanza"

[isoutamo]

If your time stamp's date can be one or two character you should try something like

LINE_BREAKER = ([\n\r]+)\s?\d{1,2}/\d{2}/\d{2,4}......