logs with no timestamp automatically show +15 hrs of time stamp

[KulvinderSingh]

"CEF:0|Bitdefender|GravityZone|6.35.1-1|35|Product Modules Status|5|BitdefenderGZModule=modules dvchost=xxx      BitdefenderGZComputerFQDN=xxxxx dvc=x.x.x.x deviceExternalId=xxxxx BitdefenderGZIsContainerHost=0 BitdefenderGZMalwareModuleStatus=enabled BitdefenderGZBehavioralScanAVCModuleStatus=enabled BitdefenderGZDataLossPreventionModuleStatus=disabled"

The logs are from Bitdefender and they show a time diff of +15 hrs. and there is no timestamp in logs no other source types from same HF show the behavior only bit-defender logs. All the help is appreciated to correct the time.

[KulvinderSingh · Accepted solution]

It was an issue with NTP sync on the servers got it corrected and its fine now.

[PickleRick]

1. Check the sourcetype props

2. CEF typically comes with a syslog header. You're not showing the header - maybe it's been cut after the time had beed parsed out from it.

It all boils down to verifying:

1) Raw format of the data coming from the source with tcpdump to be sure what's on the wire

2) Settings for the sourcetype - how the timestamp is being parsed/assigned and how the event is modified on ingestion.

[KulvinderSingh]

Thanks @PickleRick let me check will update.