getting data from Splunk HTTP Event Collector (HEC) and forwarding to indexers. On the Heavy Forwarder where the HEC is installed, I have props.conf to extract timestamp from events. But my props.conf is not working on it.
If I ingest a test event then it is working but for same sourcetype. If I ingest same data through HEC, it is not extracting time. Is there any Issue?
↧