Lines in log file not indexed if line has time stamp from the past

[loligator]

Hello all,

One of our home grown apps copies logs to a directory monitored by Splunk once a day around midnight. Splunk, however, will not index the events in the log if they contain a past time stamp. The lines in the log look similar to this:

12/18/2021,00:00:20,UDP,Rcv,10.132.133.29,app-measurement.com

These lines are skipped, however, if the line looks like this it will be indexed:

UDP,Rcv,10.132.133.29,app-measurement.com

It appears having a date and time in the log is causing the forwarder to not forward the data. 

Here's the input.conf for the Splunk app that handles the files:

[monitor://C:\Logs\CustomApp]
disabled = 0
index = customapp
sourcetype = customappevents
recursive = false
blacklist = \.tmp$
crcSalt = <SOURCE>

Thanks in advance!

[scelikok]

Hi @loligator,

Universal Forwarder does not care if the event content. Most probably Splunk is indexing those events using the old timestamps. Since the other lines have no timestamp indexers are using current time.  

If your events has no proper timestamps, you can use DATETIME_CONFIG=CURRENT setting in your sourcetype.

You should put this setting to your indexers.

props.conf

[customappevents]
DATETIME_CONFIG = CURRENT

[loligator]

Hey!

Thanks for the reply. I did some further troubleshooting and here's what is happening to the events when they have the date and time attached:

\x001\x002\x00/\x002\x000\x00/\x002\x000\x002\x001\x00,\x002\x003\x00:\x004\x008\x00:\x005\x001\x00,\x00U\x00D\x00P\x00,\x00R\x00c\x00v\x00,\x001\x00.\x001\x00.\x001\x00.\x003\x00,\x00g\x00s\x00a\x00s\x00.\x00a\x00p\x00p\x00l\x00e\x00.\x00c\x00o\x00m\x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00

This is how it's displayed and I have no idea why. 

[isoutamo]

Hi

you have wrong character set in use. See more e.g. https://community.splunk.com/t5/Security/SQL-Server-ERRORLOG/m-p/103382

r. Ismo

[loligator]

Thanks I'll give this a go shortly and report back. I appreciate the help.