Splunk - Assigning custom time

user_3401331 0
Viewed 69

I want my time to be the "Date" property in the following json:

{ "Level": "ERROR", "Date": "2021-08-20 17:21:53.6355", "Logger":.... }

I created a props.conf here: ...\Splunk\etc\system\local with:

TIME_PREFIX=\"Date\":
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4N

I then restarted splunk...but it's not working. Any idea what I'm missing?

splunk-query splunk
1 Answers

The current settings say Splunk should find a 4-digit year immediately following '"Date":', but that's not the case. Try TIME_PREFIX = "Date":\s". There's no need to escape the quotation marks.

user_22274200
Related