Wrong timestamp in Splunk for Palo Alto Network logs

[johan_ryberg]

Hi,

I'm sending syslog from my PAN device to splunk and it's indexed with a date stating 2010 instead of 2014.

Both index server and PAN device are using Europe/Stockholm and if I tcpdump traffic it's looks OK.

But then I'm searching in splunk they all are dated 2010.

Could someone point me in the correct direction how to fix this?

Tnx

// Johan

[btorresgil · Accepted solution]

Hello,

Usually the clock or timezone is wrong on the Splunk server or firewall, but since you checked that, you're probably missing the "no_appending_timestamp = true" in your inputs.conf. Make sure the inputs.conf entry looks something like this:

[udp//5514]
connection_host = ip
index = pan_logs
sourcetype = pan_log
no_appending_timestamp = true

Here is a guide on configuring and troubleshooting the app:

https://live.paloaltonetworks.com/docs/DOC-6593

Please let us know if that fixes the issue. Thanks!

[ditty77]

Hi!

I tried adding this line to my inputs.conf -> no_appending_timestamp = true

but I am still seeing logs come in to splunk with the UTC time even though the log itself shows a central timestamp.

[johan_ryberg]

Yes, that was the problem. I thought I had no_appending_timestamp = true in the file but it was missing.

Thanks