Getting Data In

Delay in logs from Incapsula to S3 Bucket

brewster88
New Member

Morning Guys,

We are currently having an issue with our Incapsula WAF sending logs to our AWS s3 Bucket with a delay and hoping to use a query within Splunk to provide evidence of these delays.

So far I have got as far as the following:

index=incapsula | eval delay_sec=_indextime-_time | convert ctime(_indextime) AS indextime | eval now=now() | table _time indextime now date_zone source sourcetype host

This gives a table similar to what I am after, however Im looking for the actual time stamps (epoch) on the events as they happened and the actual time the log file arrived in the s3 bucket rather than the time the log file arrived at the index, any thoughts on how to modify this query to get the necessary information at all?

Cheers guys

0 Karma
1 Solution

woodcock
Esteemed Legend

This is not possible. You will have to build some other process in AWS to add more data and then send that to Splunk, too, and correlate it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

This is not possible. You will have to build some other process in AWS to add more data and then send that to Splunk, too, and correlate it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...