no_appending_timestamp behaviour for splunktcp source

[acalvo]

Scenario: I want to forward syslog data using a splunk universal forwarder. However, when it gets to the central splunk server, it has double timestamp and an incorrect host (the splunk forwarder).

Question: How can I reproduce the same behaviour that the option no_appending_timestamp does for an UPD source but for a SPLUNKTCP source in etc/apps/search/local/inputs.conf?

Solution?: So far I'm trying using the TRANSFORMS-stripheaders = syslog-header-stripper-ts-host in etc/system/local/props.conf?

Current inputs.conf:

[splunktcp://9997]
sourcetype = syslog

Current props.conf:

[source::...mytest...]
TRANSFORMS-stripheaders = syslog-header-stripper-ts-host syslog-host

[jrodman]

Splunk forwarding and receiving wont add anything to the text, so that's not where this is occurring. I'm not sure how the data is coming into the forwarder, but it sounds like you have a [udp:] stanza on the forwarder? That's where you'd need to set up the no_appending_timestamp=true

However, your props refers to source::...mytest... which makes me think youre getting this data from files. So I'm not sure. Maybe stop by IRC or work with support.

[jrodman]

The 'double' timestamp may just be the splunk UI, then. Maybe a picture would help.

As for getting the hostname from the data, this is a matter of your monitor stanza configuration. Be sure to set it to syslog.

[acalvo]

I'm just monitoring files which are a dump of a syslog message, so they already have the original timestamp.

Can I use the something similar?

Thanks