Time Conversion of Cisco FTD Logs

teco_akelly — Sun, 19 Sep 2021 13:38:41 GMT

I have several Cisco FTD devices (managed by Cisco FMC) that are sending syslog messages to splunk. Here is the format....

<164>Sep 19 2021 13:26:27 ftdv-b-int : %FTD-4-313005: No matching connection for ICMP error message: icmp src inside_Mgmt:10.0.20.238 dst inside_Legacy_Server:192.168.0.94 (type 3, code 3) on inside_Mgmt interface. Original IP payload: udp src 192.168.0.94/53 dst 10.0.20.238/12055.

The time is in UTC.... is there a way to convert this time to local when I pull the records in so I can do alerting, etc. on these records?

Re: Time Conversion of Cisco FTD Logs

richgalloway — Sun, 19 Sep 2021 14:25:11 GMT

Splunk will convert the time zone for you. You just need to tell it what time zone the event occurs in. Do that by specifying TZ = UTC in props.conf for the appropriate sourcetype.

I'd be remiss if I missed this opportunity to point out that one should not send syslog directly to a Splunk TCP or UDP port. Instead, send it to a dedicated syslog server and forward it to Splunk or use Splunk Connect for Syslog.

topic Re: Time Conversion of Cisco FTD Logs in Getting Data In

Time Conversion of Cisco FTD Logs

Re: Time Conversion of Cisco FTD Logs