Solved: no_appending_timestamp and syslog-ng clarification

mikefg · ‎08-14-2019

Just need to clarify - if I'm using syslog-ng to receive udp syslog I do not need the no_appending_timestamp = true in inputs.conf, correct? The no_appending_timestamp = true is used when receiving udp and not using a log collector like syslog-ng.

richgalloway · ‎08-15-2019

You do not need to set no_appending_timestamp=true.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎08-15-2019

You do not need to set no_appending_timestamp=true.

---
If this reply helps you, Karma would be appreciated.

no_appending_timestamp and syslog-ng clarification

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

Announcing Modern Navigation: A New Era of Splunk User Experience

Data Drivers: How We're Streaming Real-Time F1 Telemetry Directly into Splunk ...

Join the Conversation