All Apps and Add-ons

streamfwdcapture.<N>.sysTime does not seem to work

Observer

Hi, all,

I'm trying to ingest pcap files using Splunk Stream with the config shown below.

 

[streamfwd]
streamfwdcapture.0.interface = /tmp/pcap/
streamfwdcapture.0.offline = true
streamfwdcapture.0.sysTime = false

 

Although pcap ingestion itself is successful, the record timestamps are not actual ones from pcap files, and the system time seems to be used instead. (To me, streamfwdcapture.0.sysTime in the conf does not properly work).

Does anyone have the same experience, and any solutions?

Below is the environment I tried

  • Splunk 7.3.6
  • Splunk Stream 7.2.0
Labels (1)
0 Karma