All Apps and Add-ons

Kinesis AWS Input - Timestamp recognition

606866581
Path Finder

I use kinesis heavily to pull a wide variety of logs from AWS. However I've noticed the timestamps within the logs are being ignored. Some of the events don't have timestamps and so the automatic _time is acceptable, however when my log starts with
2018-07-17T16:10:00Z
I'd expect _time to be the same (adusted for timezone), however the AWS Add-on set _time to be 16:11:56 which appears nowhere in the log.

So it appears kinesis has some internal logic for calculating the timestamp and ignores the timestamp at the start of the log.

Has anyone else had this issue or found a solution?

0 Karma

snosurfur
Engager

We also use kinesis, and are pulling in vpcflow logs and recently found a solution to the log time. I will share my thoughts in hopes that it either turns out to be a solution for you or point you in the right direction.

Option 1:
This will use the current time of the splunk server to log the time of the event and convert/read epoch time.

Edit/Create a props.conf file in %SPLUNK%\etc\system\local

[]
TIME_PREFIX = CURRENT

TIME_FORMAT = %s

Option 2:
This will take either the start time of the event or end time, however you configure regexp.

Edit/Create a props.conf file in %SPLUNK%\etc\system\local

Start time of event
[]
TIME_PREFIX = ^([^ ]+\s){10}

TIME_FORMAT = %s

End time of event
[]
TIME_PREFIX = ^([^ ]+\s){11}

TIME_FORMAT = %s

Keeping in mind these are configured specifically formatted for vpc flow logs.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...