Getting Data In
Highlighted

no_appending_timestamp behaviour for splunktcp source

Explorer

Scenario: I want to forward syslog data using a splunk universal forwarder. However, when it gets to the central splunk server, it has double timestamp and an incorrect host (the splunk forwarder).

Question: How can I reproduce the same behaviour that the option no_appending_timestamp does for an UPD source but for a SPLUNKTCP source in etc/apps/search/local/inputs.conf?

Solution?: So far I'm trying using the TRANSFORMS-stripheaders = syslog-header-stripper-ts-host in etc/system/local/props.conf?

Current inputs.conf:

[splunktcp://9997]
sourcetype = syslog

Current props.conf:

[source::...mytest...]
TRANSFORMS-stripheaders = syslog-header-stripper-ts-host syslog-host
0 Karma
Highlighted

Re: no_appending_timestamp behaviour for splunktcp source

Champion

Splunk forwarding and receiving wont add anything to the text, so that's not where this is occurring. I'm not sure how the data is coming into the forwarder, but it sounds like you have a [udp:] stanza on the forwarder? That's where you'd need to set up the no_appending_timestamp=true

However, your props refers to source::...mytest... which makes me think youre getting this data from files. So I'm not sure. Maybe stop by IRC or work with support.

0 Karma
Highlighted

Re: no_appending_timestamp behaviour for splunktcp source

Explorer

I'm just monitoring files which are a dump of a syslog message, so they already have the original timestamp.

Can I use the something similar?

Thanks

0 Karma
Highlighted

Re: no_appending_timestamp behaviour for splunktcp source

Champion

The 'double' timestamp may just be the splunk UI, then. Maybe a picture would help.

As for getting the hostname from the data, this is a matter of your monitor stanza configuration. Be sure to set it to syslog.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.