topic Re: Ingesting Cisco ISE logs - wrong timestamp in Splunk Dev

Ingesting Cisco ISE logs - wrong timestamp

montgomeryam — Tue, 22 Jan 2019 17:11:47 GMT

Hello!

We are trying to track down issues with ingesting UDP syslog data from Cisco ISE in which it is being indexed in the wrong year timestamp. What I can see is that the events are often being collected as far back as 1986. I understand that we can utilize a props.conf to configure timestamp recognition on events that are missing identifiable timestamps.

Anyone else have this issue and were you able to fix it in props.conf?

Thanks!

Re: Ingesting Cisco ISE logs - wrong timestamp

dkeck — Tue, 22 Jan 2019 17:16:24 GMT

Did you try to use the TA for cisco ise? its for collecting ise syslog data
https://splunkbase.splunk.com/app/1915/#/overview

Re: Ingesting Cisco ISE logs - wrong timestamp

montgomeryam — Tue, 22 Jan 2019 17:26:51 GMT

No, but you gave me an awesome idea!

If we can't install the TA directly, we are a University and getting these installs takes some effort, then I will bust open the props.conf on the Cisco ISE TA and use those stanzas as first stab.

Thanks for sparking that idea!

Re: Ingesting Cisco ISE logs - wrong timestamp

dkeck — Thu, 24 Jan 2019 07:48:38 GMT

Happy to help. It would be great if you could accept the answer 🙂