topic Re: What is the best practice for avoiding irrelevant date in Cisco log being taken as time stamp? in Getting Data In

What is the best practice for avoiding irrelevant date in Cisco log being taken as time stamp?

bkatzlin — Mon, 24 Jun 2019 09:11:27 GMT

Hi,
what would be the best practice for avoiding that a recent log line like the following one would be wrongly tagged as coming from two years ago?

Jun 23 23:15:47 cisco123.mylocal.net Compiled Fri 20-Oct-17 20:51 by prod_rel_team

 current sourcetype: cisco:ios
 _time: 2017-10-20T23:15:47.000

My plan would be setting a specific subtype and disabling the timestamp processor for that particular case.
transforms.conf:

[set_subtype_compiled_message]
REGEX = Compiled\s\w+\s\d+-\w+-\d+\s\d+:\d+\sby
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype:cisco:ios_compiled

props.conf:

[cisco:ios]
TRANSFORMS-set_subtype_compiled_message

[cisco:ios_compiled]
DATETIME_CONFIG = NONE

Any better ideas, pros and cons?

Regards,
Bernd

Re: What is the best practice for avoiding irrelevant date in Cisco log being taken as time stamp?

Azeemering — Wed, 30 Sep 2020 01:02:22 GMT

In the props.conf use:

[cisco:ios]
MAX_TIMESTAMP_LOOKAHEAD=15
TIME_FORMAT=%b %d %H:%M:%S      
TIME_PREFIX =^

MAX_TIMESTAMP_LOOKAHEAD --> The number of characters into an event Splunk software should look
for a timestamp.
TIME_FORMAT -->Specifies a "strptime" format string to extract the date.
TIME_PREFIX -->If set, Splunk software scans the event text for a match for this regex. In this case the ^ asserts position at start of a line

Re: What is the best practice for avoiding irrelevant date in Cisco log being taken as time stamp?

woodcock — Mon, 24 Jun 2019 14:45:55 GMT

Never ever let splunk guess at timestamp; always set the magic 6:
https://www.sicherevielfalt.de/blog/the-ultimate-splunk-magic-8-for-a-dramatic-performance-boost/
https://splunkbase.splunk.com/app/4162/

Re: What is the best practice for avoiding irrelevant date in Cisco log being taken as time stamp?

sloshburch — Tue, 16 Jul 2019 15:26:59 GMT

Reminds me of What are the best practices for defining source types? so cross linking.