All Apps and Add-ons

Cisco ISE Timestamp Issue

Path Finder

Hi there,

we have an issue regarding timestamps of events from cisco ISE.

Events come via syslog/UDP in the following form:

Jun 5 12:57:45 Jun 5 12:57:41 PRDO0001 CISE_Failed_Attempts 0000011272 1 0 2014-06-05 12:57:41.504 +01:00 0008339654 5400 NOTICE Failed-Attempt: Authentication failed, blabla blabla lots of other stuff

The event timestamp that is extracted by splunk is
Jun 5 12:57:45 - I guess that is the time the event was received via udp.

The correct timestamp would be
2014-06-05 12:57:41.504

The ISE app delivers a props.conf with the following settings:



DATETIME_CONFIG = /etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml

TIME_PREFIX = \d\s\d\s

TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N %Z



TRANSFORMS-cisco-ise = cisco-ise-sourcetyper

DATETIME_CONFIG = /etc/apps/Splunk_TA_cisco-ise/default/datetime_udp.xml


The XML-file contains this (no xml allowed here, so just parts of it):

;define name="_datetimeCiscoISE" extract="year, month, day, hour, minute, second, subsecond, zone";

!-- Target TimeFormat: 2014-01-09 22:33:35.123 +00:00 --


All of this is out-of-the-box ISE app stuff, we changed nothing there.

So for me this looks like everything is configured the right way - nevertheless the timestamp is not extracted correctly.

As I just understand about half of this config I would be very grateful for any help regarding this.



0 Karma

Path Finder

Hi there - solved it.

I changed the timestamp configuration in props.conf to:








0 Karma

Path Finder

Hi! It appears that I'm facing the same issue as you. Well almost. My problem is that I want the event to break when it hits a new line containing the timestamp for the creation time, and not for each line containing the receive time (which is the default). Also I want the events to get the timestamp of the creation time. Is that what you managed with your props.conf configuration?

0 Karma

Super Champion

Hi @tsomod, could you please make a new question and give an example of the events so we can help you out ?

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...