Ingesting Cisco ISE logs - wrong timestamp

[montgomeryam]

Hello!

We are trying to track down issues with ingesting UDP syslog data from Cisco ISE in which it is being indexed in the wrong year timestamp. What I can see is that the events are often being collected as far back as 1986. I understand that we can utilize a props.conf to configure timestamp recognition on events that are missing identifiable timestamps.

Anyone else have this issue and were you able to fix it in props.conf?

Thanks!

[dkeck · Accepted solution]

Did you try to use the TA for cisco ise? its for collecting ise syslog data
https://splunkbase.splunk.com/app/1915/#/overview

[montgomeryam]

No, but you gave me an awesome idea!

If we can't install the TA directly, we are a University and getting these installs takes some effort, then I will bust open the props.conf on the Cisco ISE TA and use those stanzas as first stab.

Thanks for sparking that idea!

[dkeck]

Happy to help. It would be great if you could accept the answer 🙂