How to correct an incorrect time value?

dahlberg — Wed, 29 Mar 2017 18:24:40 GMT

I have the following event being sent from a Universal Forwarder (UF) syslog server to a standalone instance of Splunk:

4656Open Object101.3CIFS000x8020000000000000Audit SuccessSecurityc5e81075-f14f-11e3-9b1e-123478563412/cd4c5993-11b0-11e4-92a9-123478563412134.82.79.10S-1-5-21-2136110353-913448559-1712093940-13349falseBUCKNELLleisnhth-aSecurityFile00000000000466;00;015ce358;514e6b60(netspace_departments);/isr/public/www2/bu_only/AICT/images/oversize/IRM195.jpg%%4423 %%1538 2080Read Attributes; Read ACL;

The data is obviously in an XML format. I created a subdirectory within $SPLUNK_HOME/etc/deployment-apps/IA-naaudit and in the default dir I have an inputs.conf:

[monitor:///var/log/rsyslogs/Netapp/audit_svm_netspace_last.xml] 
index = netapp 
sourcetype = audit 
_TCP_ROUTING = dev_splunk

and an outputs.conf

[tcpout:dev_splunk] 
server = sptest:9996

I manually replicated these dirs and files on the UF in /opt/splunkforwarder/etc/apps/

I am now receiving the event data shown above.

On the standalone instance I created the dir $SPLUNK_HOME/etc/deployment-apps/TA-naaudit and in the local dir I created
props.conf:

[netapp] 
KV_MODE = xml 
TIME_PREFIX = \ntscripts\< 
DEST_KEY = queue 
FORMAT = nullQueue

Here is my problem: from the event you can see that it should have the timestamp "2017-03-27T16:18:55.218021000Z". When I do a search on index=netapp this event (along with a gazillion others) it gets the time stamp "3/27/17 12:40:40.000 PM" which is incorrect.

Also, I'm trying to drop the events with the user "ntscripts" but they show up in the search as well.

Can you tell me where I'm going wrong?

Thanks,
Mike

Re: How to correct an incorrect time value?

somesoni2 — Tue, 29 Sep 2020 13:25:41 GMT

The directory $SPLUNK_HOME/etc/deployment-apps is for storing the deployment app that you push if your current server is a deployment server. Since you copied the app IA-naaudit with inputs.conf manually on UF, that was fine. You need to place the $SPLUNK_HOME/etc/deployment-apps/TA-naaudit in $SPLUNK_HOME/etc/apps/TA-naaudit directory, place from where your standalone Splunk instance will read/load the configuration.

Re: How to correct an incorrect time value?

woodcock — Thu, 30 Mar 2017 03:49:37 GMT

You need this setting, too:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%9N%z

Re: How to correct an incorrect time value?

dahlberg — Thu, 30 Mar 2017 14:06:56 GMT

Thanks. I used btool and found I wasn't loading that particular props.conf file.

topic Re: How to correct an incorrect time value? in Getting Data In

How to correct an incorrect time value?

Re: How to correct an incorrect time value?

Re: How to correct an incorrect time value?

Re: How to correct an incorrect time value?