Security

Splunk VPC timestamp issue

General_Talos
Path Finder

Hey,

I am sure many of you, who have VPC logs on Splunk have came across this issue. 

Raw Log

2 unknown eni-xxxxxxxxxxxxx 192.168.0.10 192.168.0.15 3558 6443 6 9 1196 1625657222 1625657282 ACCEPT OK

Text highlighted in red is event start_time, and I want to replace it with _time

my props.conf

 

[aws:cloudwatchlogs:vpcflow]
TIME_FORMAT = %s
SHOULD_LINEMERGE = false
TIME_PREFIX = ^(?>\S+\s){10}
MAX_TIMESTAMP_LOOKAHEAD = 10

 

Still no luck :disappointed_face:

General_Talos_0-1626263811814.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

TIME_PREFIX = (\S+\s+){10}
0 Karma

General_Talos
Path Finder

Hello @ITWhisperer , thks for sharing. Still the same.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...