We are trying to track down issues with ingesting UDP syslog data from Cisco ISE in which it is being indexed in the wrong year timestamp. What I can see is that the events are often being collected as far back as 1986. I understand that we can utilize a props.conf to configure timestamp recognition on events that are missing identifiable timestamps.
Anyone else have this issue and were you able to fix it in props.conf?
No, but you gave me an awesome idea!
If we can't install the TA directly, we are a University and getting these installs takes some effort, then I will bust open the props.conf on the Cisco ISE TA and use those stanzas as first stab.
Thanks for sparking that idea!