All Apps and Add-ons

How to configure the Splunk Add-on for Netflow or indexer to capture the correct time stamp for Netflow log data?

jeffrey2015
Engager

Running the Splunk Add-on for Netflow on a Linux server so it can translate the data and forward it to our main Splunk instance running on Windows. The Netflow data on the Linux box looks something like this for date and time:

1969-12-31 19:00:00,1969-12-31 19:00:00,0.000

This then gets sent over to our indexer (Windows box) and it stamps it with the right date, but the time it stamps it with is 7PM. What can I adjust in the Netflow add-on or on the indexer to get it to stamp it with the correct times?

thejohn
Path Finder

I encountered this same issue when collecting Netflow v9. However, when using v5, it sets the correct timestamp. I think there's an issue with nfdump that comes with this add-on.

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

Hi
Do you mean you want the time to show in 24h clock instead 12h clock? in other words in your example that would be 19:00 instead of 7PM?
If this is the case you can do so by changing the locale. Here are some useful links:
https://answers.splunk.com/answers/10643/time-format-for-results-in-en-us-vs-en-gb.html
https://answers.splunk.com/answers/12509/possible-to-set-user-interface-to-show-24-clock.html

0 Karma

jeffrey2015
Engager

No, it is more like the time itself is way off the line above was captured about 30 minutes ago. The correct time should have been 1:07PM EST.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!