topic Re: no_appending_timestamp behaviour for splunktcp source in Getting Data In

no_appending_timestamp behaviour for splunktcp source

acalvo — Thu, 17 Mar 2011 21:29:05 GMT

Scenario: I want to forward syslog data using a splunk universal forwarder. However, when it gets to the central splunk server, it has double timestamp and an incorrect host (the splunk forwarder).

Question: How can I reproduce the same behaviour that the option no_appending_timestamp does for an UPD source but for a SPLUNKTCP source in etc/apps/search/local/inputs.conf?

Solution?: So far I'm trying using the TRANSFORMS-stripheaders = syslog-header-stripper-ts-host in etc/system/local/props.conf?

Current inputs.conf:

[splunktcp://9997]
sourcetype = syslog

Current props.conf:

[source::...mytest...]
TRANSFORMS-stripheaders = syslog-header-stripper-ts-host syslog-host

Re: no_appending_timestamp behaviour for splunktcp source

jrodman — Fri, 18 Mar 2011 14:58:04 GMT

Splunk forwarding and receiving wont add anything to the text, so that's not where this is occurring. I'm not sure how the data is coming into the forwarder, but it sounds like you have a [udp:] stanza on the forwarder? That's where you'd need to set up the no_appending_timestamp=true

However, your props refers to source::...mytest... which makes me think youre getting this data from files. So I'm not sure. Maybe stop by IRC or work with support.

Re: no_appending_timestamp behaviour for splunktcp source

acalvo — Fri, 18 Mar 2011 15:44:00 GMT

I'm just monitoring files which are a dump of a syslog message, so they already have the original timestamp.

Can I use the something similar?

Thanks

Re: no_appending_timestamp behaviour for splunktcp source

jrodman — Fri, 18 Mar 2011 16:06:12 GMT

The 'double' timestamp may just be the splunk UI, then. Maybe a picture would help.

As for getting the hostname from the data, this is a matter of your monitor stanza configuration. Be sure to set it to syslog.