Building for the Splunk Platform

Ingesting Cisco ISE logs - wrong timestamp

montgomeryam
Path Finder

Hello!

We are trying to track down issues with ingesting UDP syslog data from Cisco ISE in which it is being indexed in the wrong year timestamp. What I can see is that the events are often being collected as far back as 1986. I understand that we can utilize a props.conf to configure timestamp recognition on events that are missing identifiable timestamps.

Anyone else have this issue and were you able to fix it in props.conf?

Thanks!

Tags (1)
0 Karma
1 Solution

dkeck
Influencer

Did you try to use the TA for cisco ise? its for collecting ise syslog data
https://splunkbase.splunk.com/app/1915/#/overview

View solution in original post

0 Karma

dkeck
Influencer

Did you try to use the TA for cisco ise? its for collecting ise syslog data
https://splunkbase.splunk.com/app/1915/#/overview

0 Karma

montgomeryam
Path Finder

No, but you gave me an awesome idea!

If we can't install the TA directly, we are a University and getting these installs takes some effort, then I will bust open the props.conf on the Cisco ISE TA and use those stanzas as first stab.

Thanks for sparking that idea!

0 Karma

dkeck
Influencer

Happy to help. It would be great if you could accept the answer 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...