Getting Data In

how to discard data before a timestamp?

wojtek_swiatek
Path Finder

Hello

I get some data (TCP syslog) from a Juniper VPN server. Unfortunately they are incorrectly parsed by splunk because some data is prepended before the timestamp. A sample of the data (this is all in one block) is below, I have replaced by INFOINFOINFO the actual data from systlog (which varies):

197 <134>Juniper: 2014-07-03 17:11:02 - INFOINFONFO234 <134>Juniper: 2014-07-03 17:11:02 - INFOINFOINFO194 <134>Juniper: 2014-07-03 17:11:02 - INFOINFOINFO

How can I tell splunk to discard (first example) the string 197 <134>Juniper: as the actual syslog data is afterwards?

Thank you!

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Modify your props.conf file and add a 'TIME_PREFIX = Juniper:' statement to the appropriate stanza.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Modify your props.conf file and add a 'TIME_PREFIX = Juniper:' statement to the appropriate stanza.

---
If this reply helps you, Karma would be appreciated.
0 Karma

wojtek_swiatek
Path Finder

After some more checks I see that:
- a single line starting with "Juniper:" is indexed properly (the Juniper: prefix is not removed, though. But the indexed times are OK)
- when several lines are concatenated they are not broken into single ones (all start with Juniper:)

0 Karma

wojtek_swiatek
Path Finder

Thank you - I added
[source::tcp:25890]
TIME_PREFIX = Juniper:

(two lines) to /opt/splunk/etc/system/local/props.conf but I still get the same chunks (I tested this by sending the sting in my question via netcat splunk.example.com 25890). Is there a way to debug or would you see another place I should add something?

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...