Scenario: I want to forward syslog data using a splunk universal forwarder. However, when it gets to the central splunk server, it has double timestamp and an incorrect host (the splunk forwarder).
Question: How can I reproduce the same behaviour that the option no_appending_timestamp does for an UPD source but for a SPLUNKTCP source in etc/apps/search/local/inputs.conf?
Solution?: So far I'm trying using the TRANSFORMS-stripheaders = syslog-header-stripper-ts-host in etc/system/local/props.conf?
[splunktcp://9997] sourcetype = syslog
[source::...mytest...] TRANSFORMS-stripheaders = syslog-header-stripper-ts-host syslog-host
Splunk forwarding and receiving wont add anything to the text, so that's not where this is occurring. I'm not sure how the data is coming into the forwarder, but it sounds like you have a [udp:] stanza on the forwarder? That's where you'd need to set up the no_appending_timestamp=true
However, your props refers to source::...mytest... which makes me think youre getting this data from files. So I'm not sure. Maybe stop by IRC or work with support.
I'm just monitoring files which are a dump of a syslog message, so they already have the original timestamp.
Can I use the something similar?
The 'double' timestamp may just be the splunk UI, then. Maybe a picture would help.
As for getting the hostname from the data, this is a matter of your monitor stanza configuration. Be sure to set it to syslog.