Hello,
we have tried to edit our sourcetype as described in the followig article:
https://www.splunk.com/blog/2009/12/02/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename.html
Pulling the date out of the non standard filename works fine, but we can´t save the config to our sourcefile.
Everytime we set the parameter:
DATETIME_CONFIG = /etc/system/local/datetime.xml
in our props.conf splunk doesn´t save this parameter.
Eding props.conf directly does have the same behaviour.
Thanks for the help!
↧