Getting Data In

how to discard data before a timestamp?

wojtek_swiatek
Path Finder

Hello

I get some data (TCP syslog) from a Juniper VPN server. Unfortunately they are incorrectly parsed by splunk because some data is prepended before the timestamp. A sample of the data (this is all in one block) is below, I have replaced by INFOINFOINFO the actual data from systlog (which varies):

197 <134>Juniper: 2014-07-03 17:11:02 - INFOINFONFO234 <134>Juniper: 2014-07-03 17:11:02 - INFOINFOINFO194 <134>Juniper: 2014-07-03 17:11:02 - INFOINFOINFO

How can I tell splunk to discard (first example) the string 197 <134>Juniper: as the actual syslog data is afterwards?

Thank you!

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Modify your props.conf file and add a 'TIME_PREFIX = Juniper:' statement to the appropriate stanza.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Modify your props.conf file and add a 'TIME_PREFIX = Juniper:' statement to the appropriate stanza.

---
If this reply helps you, Karma would be appreciated.
0 Karma

wojtek_swiatek
Path Finder

After some more checks I see that:
- a single line starting with "Juniper:" is indexed properly (the Juniper: prefix is not removed, though. But the indexed times are OK)
- when several lines are concatenated they are not broken into single ones (all start with Juniper:)

0 Karma

wojtek_swiatek
Path Finder

Thank you - I added
[source::tcp:25890]
TIME_PREFIX = Juniper:

(two lines) to /opt/splunk/etc/system/local/props.conf but I still get the same chunks (I tested this by sending the sting in my question via netcat splunk.example.com 25890). Is there a way to debug or would you see another place I should add something?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...