Data Summary Earliest Event from many Years ago

[mcronkrite]

After setting up the Splunk Add-On for *NIX (Splunk_TA_nix) and enabling the scripts now my data summary shows that the earliest event is from several years ago. Sometimes 4 years, sometimes 14 years depending on the OS.

[mcronkrite · Accepted solution]

This is due to the parsing in the Splunk_TA_Nix app that is attempting to read off dates from nix files that have comments in them.

For example when installing Splunk_TA_Nix on a MacOS and enabling the /etc/ script in the app setup, the data summary not indicates that the earliest event was 4 years ago. Even though this install of splunk is only minutes old. The reason is that depending on the OS you will have files indexed that have date inside them. On the MacOS this file was indexed and the event timestamp was given from inside the file's first line. On RedHat systems a similar behavior occurs and a 14 year old date is entered for an event.

You can confirm this by doing a search near the oldest data like this (sub in the years of interest)

index="os" earliest=12/31/2009:0:0:0 latest=12/31/2011:0:0:0 | sort _time

You can find the data that is coming in as "old", notice how the data Splunk chose for the event was based on the first date contained in the file. Because this is a conf file from /etc/ssh_config the date is accurate with respect to when the file is dated.

>Splunk event time: 1/11/10 1:39:46.000 AM  
>#  $OpenBSD: ssh_config,v 1.26 2010/01/11 01:39:46 dtucker Exp $
># This is the ssh client system-wide configuration file.  See
># ssh_config(5) for more information.  This file provides defaults for