I have configured monitoring for a set of files. I have configured the props.conf to use the 'last modified' time of the file as the timestamp for each event. However, the events are being indexed for 04/10/2014 for some reason.
Sample files on the server with their last modified times:
-rw-r--r--. 1 datasvcs datasvcs 14239 Jan 27 11:00 filename20170127_10.gz
-rw-r--r--. 1 datasvcs datasvcs 14497 Jan 27 12:00 filename20170127_11.gz
-rw-r--r--. 1 datasvcs datasvcs 14143 Jan 27 13:00 filename20170127_12.gz
Indexed data for said files (notice the _time from below vs the last modified time from above):
source _time count
/data/datasvcs/directory_path/filename20170127_10.gz 2014-04-10 465
/data/datasvcs/directory_path/filename20170127_11.gz 2014-04-10 473
/data/datasvcs/directory_path/filename20170127_12.gz 2014-04-10 453
Props.conf configuration:
/opt/splunk/etc/slave-apps//local/props.conf [sourcetype_name]
/opt/splunk/etc/slave-apps//local/props.conf DATETIME_CONFIG = NONE
/opt/splunk/etc/slave-apps//local/props.conf FIELD_NAMES =
-
/opt/splunk/etc/slave-apps/