https://community.splunk.com/t5/Getting-Data-In/How-to-modify-syslog-source-type-to-handle-rfc3339-timestamp/m-p/483064#M82756 <P>We pass messages with rsyslog using the rfc3339 time format. It has microseconds, and it has a timestamp. But noticed a few issues:</P> <UL> <LI>The time zone is not parsed out of the message. If I remove the microseconds from the timestamp, it would work fine.</LI> <LI>The host does not get parsed out. Seems to be a problem with the syslog-host transform which does not like the timezone. Dropping the timezone fixes this problem but I would rather keep it.</LI> </UL> <P>What would be the best way to proceed?</P> <UL> <LI>Modify the syslog source type?</LI> <LI>Create a new source type?</LI> <LI>Report the issue and hope for a fix?</LI> </UL> Sat, 25 Apr 2020 15:45:30 GMT chutz 2020-04-25T15:45:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-modify-syslog-source-type-to-handle-rfc3339-timestamp/m-p/483064#M82756 <P>We pass messages with rsyslog using the rfc3339 time format. It has microseconds, and it has a timestamp. But noticed a few issues:</P> <UL> <LI>The time zone is not parsed out of the message. If I remove the microseconds from the timestamp, it would work fine.</LI> <LI>The host does not get parsed out. Seems to be a problem with the syslog-host transform which does not like the timezone. Dropping the timezone fixes this problem but I would rather keep it.</LI> </UL> <P>What would be the best way to proceed?</P> <UL> <LI>Modify the syslog source type?</LI> <LI>Create a new source type?</LI> <LI>Report the issue and hope for a fix?</LI> </UL> Sat, 25 Apr 2020 15:45:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-modify-syslog-source-type-to-handle-rfc3339-timestamp/m-p/483064#M82756 chutz 2020-04-25T15:45:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-modify-syslog-source-type-to-handle-rfc3339-timestamp/m-p/483065#M82757 <P>The best approach (IMO) is to create a new sourcetype that parses the data.</P> Sat, 25 Apr 2020 16:37:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-modify-syslog-source-type-to-handle-rfc3339-timestamp/m-p/483065#M82757 richgalloway 2020-04-25T16:37:02Z