Event Logs sent to from heavy forwarders to Indexers and Qradar will be the same?

[R_M]

In our environment there are 2 HF's which are sending logs from different sources to splunk indexers and external tool Qradar.

So my question is suppose we have searched for any windows events for any specific timestamp, on search head and showing 20 events, so it is true that qradar will also received 20 events in same timestamp.

I tried do the same seems there difference is number, so want to confirm , how it will be.

If you can share any docs which says it will be same or not.

[VatsalJagani]

@R_M - It depends on timestamp parsing mechanism on QRadar side.

If you know Splunk has its own timestamp parsing configuration in props.conf (https://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition)

When HF forwards the log to Splunk it will forward with the extracted timestamp, vs when it will send to QRadar it will be without a timestamp.

The timestamp is not the only thing that will be different in both the tool that could impact number of events:

* line breaking

* line merging

If you make sure both have all the configurations logically the same then it should give the same count.

I hope this helps!!!