Getting Data In

how to discard data before a timestamp?

Path Finder

Hello

I get some data (TCP syslog) from a Juniper VPN server. Unfortunately they are incorrectly parsed by splunk because some data is prepended before the timestamp. A sample of the data (this is all in one block) is below, I have replaced by INFOINFOINFO the actual data from systlog (which varies):

197 <134>Juniper: 2014-07-03 17:11:02 - INFOINFONFO234 <134>Juniper: 2014-07-03 17:11:02 - INFOINFOINFO194 <134>Juniper: 2014-07-03 17:11:02 - INFOINFOINFO

How can I tell splunk to discard (first example) the string 197 <134>Juniper: as the actual syslog data is afterwards?

Thank you!

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Modify your props.conf file and add a 'TIME_PREFIX = Juniper:' statement to the appropriate stanza.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Modify your props.conf file and add a 'TIME_PREFIX = Juniper:' statement to the appropriate stanza.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Path Finder

After some more checks I see that:
- a single line starting with "Juniper:" is indexed properly (the Juniper: prefix is not removed, though. But the indexed times are OK)
- when several lines are concatenated they are not broken into single ones (all start with Juniper:)

0 Karma

Path Finder

Thank you - I added
[source::tcp:25890]
TIME_PREFIX = Juniper:

(two lines) to /opt/splunk/etc/system/local/props.conf but I still get the same chunks (I tested this by sending the sting in my question via netcat splunk.example.com 25890). Is there a way to debug or would you see another place I should add something?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!