Getting Data In

Why is the timing off between the actual log's time and the indexed event's timestamp? Logs stop displaying

gosports
New Member
 Time                           Event

11/19/10 11:59:37.000 PM Nov 18 23:59:37 10.0.0.10 Nov 19 04:59:37 filterlog: 81,16777216,,1446589294,fxp0,match,pass,in,4,0x0,,1,9886,0,none,2,igmp,28,10.0.0.13,224.0.0.251,datalength=8

date_second = 37
host = 10.0.0.10
index = main
source = udp:5140
sourcetype = PFsense1 
0 Karma

jterry
Splunk Employee
Splunk Employee

i'm guessing that splunk can't parse the PFsense timestamp. You may need to update/modify the sourcetype def.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...