topic HELP with CEF CSV time format in Knowledge Management

HELP with CEF CSV time format

yhetti — Wed, 31 Jan 2024 22:06:00 GMT

I am new to splunk and I have inherited a system that forwards log in CEF CSV format. These logs are then tar'd up and sent to the distant end (which does happen successfully). The issue I have is when the splunk server picks up the CEF CSV it has epoch time as the first entry of every log in the CEF CSV file. This makes the next hop/stop aggregator I send to unhappy.

original host (forwarder) -> splunk host -> splunk host -> master aggregator (arcsight type server)

example:

1706735561, "blah blah blah"

the file cef.csv says it's doing "_time","_raw"

When I look at what I think is the setup for time (etc/datetime.xml), _time does not have anything about epoch or %s in there.

How do I configure the CEF CSV to omit the epoch time?

As I mentioned earlier, I am totally new to splunk. Any help would be fantastic.

Re: HELP with CEF CSV time format

PickleRick — Thu, 01 Feb 2024 07:36:09 GMT

1. Do you use indexed extractions or not?

2. Do you have time extraction properly configured (TIME_PREFIX, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD)?

Re: HELP with CEF CSV time format

yhetti — Sat, 10 Feb 2024 19:50:47 GMT

Thank You for replying:

I am totally new to this so I don't have the domain knowledge.

I believe it is indexed extractions.

As far as the extraction configuration it shows _time, _raw

again I am a total noob - I appreciate any assistance.