Solved: no_appending_timestamp and syslog-ng clarification

mikefg · ‎08-14-2019

Just need to clarify - if I'm using syslog-ng to receive udp syslog I do not need the no_appending_timestamp = true in inputs.conf, correct? The no_appending_timestamp = true is used when receiving udp and not using a log collector like syslog-ng.

richgalloway · ‎08-15-2019

You do not need to set no_appending_timestamp=true.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎08-15-2019

You do not need to set no_appending_timestamp=true.

---
If this reply helps you, Karma would be appreciated.

no_appending_timestamp and syslog-ng clarification

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation