https://community.splunk.com/t5/Getting-Data-In/What-is-the-time-stamp-the-syslog-daemon-writes-to-the-syslog/m-p/601749#M104831 <P>When the syslog daemon writes to the syslog file, what is the time stamp it writes? is it the host date/time or the event date/time?</P><P>We quite often use the following in the syslog config -&nbsp;<BR /><BR /></P><LI-CODE lang="markup">template("${DATE} ${MSGHDR}${MSG}\n");</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 14 Jun 2022 15:08:16 GMT danielbb 2022-06-14T15:08:16Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-time-stamp-the-syslog-daemon-writes-to-the-syslog/m-p/601749#M104831 <P>When the syslog daemon writes to the syslog file, what is the time stamp it writes? is it the host date/time or the event date/time?</P><P>We quite often use the following in the syslog config -&nbsp;<BR /><BR /></P><LI-CODE lang="markup">template("${DATE} ${MSGHDR}${MSG}\n");</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 14 Jun 2022 15:08:16 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-time-stamp-the-syslog-daemon-writes-to-the-syslog/m-p/601749#M104831 danielbb 2022-06-14T15:08:16Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-time-stamp-the-syslog-daemon-writes-to-the-syslog/m-p/602593#M104914 <P>Hi</P><P>I suppose that you are using syslog-ng? If so you can see those macro definitions from here&nbsp;<A href="https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.18/administration-guide/60" target="_blank">https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.18/administration-guide/60</A>. That said that those hard coded (like DATE) macros are from message.</P><P>r. Ismo</P><P>&nbsp;</P> Tue, 21 Jun 2022 11:15:34 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-time-stamp-the-syslog-daemon-writes-to-the-syslog/m-p/602593#M104914 isoutamo 2022-06-21T11:15:34Z