I am pulling in SNMP polling data from some Cisco devices via shell scripts in Splunk. This all works fine apart from the indexing within Splunk. As the messages I am pulling in start with the date that the Cisco OS was compiled, all of my logs are showing as coming through on the exact same date and time!
An example- At the top of my snmpwalk output, the following is displayed -
Compiled Thu 19-Jul-07 20:06
This means that every log that comes in, Splunk is seeing and logging as from this date and time. That message never changes, so everything comes through under that exact date and time which makes the logs essentially useless. Is there a way I can get Splunk to ignore this line? I am unable to easily parse it during the script process.
One thing to note- when adding other data sources such as scanned file sources, you need to re-add the DATETIME_CONFIG line in a custom props.conf file under that Data Source