Total newbie here.
I have a data file (a few lines here):
The actual file has 500+ lines (events?) going back several months.
The first number in each line (e.g.128071848) is the date in seconds since the epoch.
How can I get splunk (using 4.1.5) to recognize this as the date?
The file is called "tns-stats-0.log.0" located in /home/lis/log/lis and I have the following in etc/system/local/props.conf.
which is supposed to, from what I can gather, treat the format as seconds since epoch.
Yet, splunk insists on assigning all of the events the time associated with the file itself.
Someone please tell me what I'm missing here. Based on what I've read in other answers and the splunk docs, this should work.
The REAL answer is that you appear to have to use sourcetype and not just [source::] in props.conf:
AND, then you have to define the sourcetype in apps/search/input.conf:
which seems a bit odd to me since I thought the global spec would be seen before the app level spec, but then what do I know.
Anyway, this now works.
answered 27 Oct '10, 21:05
Add the following to props.conf:
answered 27 Oct '10, 19:09
Try adding TIME_PREFIX=^ and perhaps take a look at MAX_TIMESTAMP_LOOKAHEAD if the rest of the event text might include something that looks like an epoch time.
answered 27 Oct '10, 17:33