topic Re: Problems with time stamp in Getting Data In

Problems with time stamp

sgarcia — Wed, 30 Mar 2022 18:37:34 GMT

I have a device that is reporting to the splunk through syslog, that device first goes through an F5 and the F5 gives me the traffic to my heavy forwarders. The problem is that the year of the time stamp is out of date, the date when a server event is generated is 2022 and in the search head, I see it as 2017. I don't know if the problem is from the origin server at the syslog protocol level or in the transport layer or at the collection level within the splunk. This issue only occurs on 3 computers out of 10.

I have reviewed the prop settings, but if I don't see the year in the source data, I will hardly be able to modify the timestamp.

Regards

Re: Problems with time stamp

ITWhisperer — Thu, 24 Mar 2022 06:50:44 GMT

What is different about those 3 computers compared to the other 7?

Re: Problems with time stamp

gcusello — Thu, 24 Mar 2022 08:05:17 GMT

Hi @sgarcia,

could you share some sample of your data, both original and parsed in Splunk if possible?

Ciao.

Giuseppe

Re: Problems with time stamp

sgarcia — Wed, 30 Mar 2022 18:28:01 GMT

Hello my friend

It was already solved, the props.conf file was configured and I could see the events reflected with the current date.

Regards

Re: Problems with time stamp

sgarcia — Wed, 30 Mar 2022 18:28:41 GMT

Hello

It was already solved, the props.conf file was configured and I could see the events reflected with the current date.

Regards