Time Conversion of Cisco FTD Logs

[teco_akelly]

I have several Cisco FTD devices (managed by Cisco FMC) that are sending syslog messages to splunk. Here is the format....

<164>Sep 19 2021 13:26:27 ftdv-b-int : %FTD-4-313005: No matching connection for ICMP error message: icmp src inside_Mgmt:10.0.20.238 dst inside_Legacy_Server:192.168.0.94 (type 3, code 3) on inside_Mgmt interface. Original IP payload: udp src 192.168.0.94/53 dst 10.0.20.238/12055.

The time is in UTC.... is there a way to convert this time to local when I pull the records in so I can do alerting, etc. on these records?

[richgalloway]

Splunk will convert the time zone for you.  You just need to tell it what time zone the event occurs in.  Do that by specifying TZ = UTC in props.conf for the appropriate sourcetype.

I'd be remiss if I missed this opportunity to point out that one should not send syslog directly to a Splunk TCP or UDP port.  Instead, send it to a dedicated syslog server and forward it to Splunk or use Splunk Connect for Syslog.