Getting Data In

What is the best practice for avoiding irrelevant date in Cisco log being taken as time stamp?

Explorer

Hi,
what would be the best practice for avoiding that a recent log line like the following one would be wrongly tagged as coming from two years ago?

Jun 23 23:15:47 cisco123.mylocal.net Compiled Fri 20-Oct-17 20:51 by prod_rel_team

 current sourcetype: cisco:ios
 _time: 2017-10-20T23:15:47.000

My plan would be setting a specific subtype and disabling the timestamp processor for that particular case.
transforms.conf:

[set_subtype_compiled_message]
REGEX = Compiled\s\w+\s\d+-\w+-\d+\s\d+:\d+\sby
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype:cisco:ios_compiled

props.conf:

[cisco:ios]
TRANSFORMS-set_subtype_compiled_message

[cisco:ios_compiled]
DATETIME_CONFIG = NONE

Any better ideas, pros and cons?

Regards,
Bernd

0 Karma
1 Solution

Builder

In the props.conf use:

[cisco:ios]
MAX_TIMESTAMP_LOOKAHEAD=15
TIME_FORMAT=%b %d %H:%M:%S      
TIME_PREFIX =^

MAXTIMESTAMPLOOKAHEAD --> The number of characters into an event Splunk software should look
for a timestamp.
TIMEFORMAT -->Specifies a "strptime" format string to extract the date.
TIME
PREFIX -->If set, Splunk software scans the event text for a match for this regex. In this case the ^ asserts position at start of a line

View solution in original post

Esteemed Legend
0 Karma

Builder

In the props.conf use:

[cisco:ios]
MAX_TIMESTAMP_LOOKAHEAD=15
TIME_FORMAT=%b %d %H:%M:%S      
TIME_PREFIX =^

MAXTIMESTAMPLOOKAHEAD --> The number of characters into an event Splunk software should look
for a timestamp.
TIMEFORMAT -->Specifies a "strptime" format string to extract the date.
TIME
PREFIX -->If set, Splunk software scans the event text for a match for this regex. In this case the ^ asserts position at start of a line

View solution in original post

Ultra Champion
0 Karma