Getting Data In

Why are a timestamp and hostname prepended to my UDP input events?

Motivator

I have Splunk listening to a handful of UDP ports for different types of syslog data. All events that come in, in addition to a timestamp and hostname in the event already, are being prepended by another timestamp and a hostname or IP.

The timestamp can be far off from the actual event, and appears to be the indexer's time(zone), where the event could be generated by a device on the other side of the globe.

This is messing with my TZ settings. How do I tell Splunk to stop doing this?

1 Solution

Motivator

This is a default behavior of Splunk, for UDP inputs. To turn off, in the appropriate inputs.conf file, under the appropriate [udp://...] stanza, add no_appending_timestamp = true.

View solution in original post

Motivator

This is a default behavior of Splunk, for UDP inputs. To turn off, in the appropriate inputs.conf file, under the appropriate [udp://...] stanza, add no_appending_timestamp = true.

View solution in original post

Motivator

I see - I have noticed this. It has never been a problem before, but four of the five client UDP inputs have their own hostname and timestamp that messes with TZ settings because the stamp is always local.

0 Karma

Splunk Employee
Splunk Employee

This is a default behavior of all syslog servers, including syslogd, rsyslog, and syslog-ng. Syslog devices usually do not generate timestamps or hostnames when the message is transmitted. The timestamps and hostnames in syslog files created by syslog server daemons are usually prepended by the server daemon when received.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!