I am trying to extract the time from event from the AV system. The output is set up to be sent to Splunk over UDP every 15 minutes. Splunk is setting _time as the download time, not the time of the event.
This is the format of the message -
Apr 12 07:04:00 10.00.00.00 Apr 12 2018 07:04:00 system.corp.net CEF:0|AV System|Manager System|2.2|444444|Device Access Control|3|rt=Apr 12 2018 11:53:17 GMT+00:00 cs1Label=Product_Entity/Endpoint
I have tried the following
TIMESTAMP_FIELDS = rt
TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%z
TIME_PREFIX = rt=
MAX_TIMESTAMP_LOOKAHEAD = 160
What am I missing?
Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex
TIME_PREFIX = rt\=
and
MAX_TIMESTAMP_LOOKAHEAD = 31
and I shouldn't use
TIMESTAMP_FIELDS = rt
Bye.
Giuseppe
Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex
TIME_PREFIX = rt\=
and
MAX_TIMESTAMP_LOOKAHEAD = 31
and I shouldn't use
TIMESTAMP_FIELDS = rt
Bye.
Giuseppe
That did not work. The events are showing Time as the download time.
Hi scottrunyon,
do you receive these logs on Indexer or on Heavy Forwarder?
where is this props.conf?
It must be on the same server that receive logs.
Bye.
Giuseppe
It is received on the indexer. I have a single instance and props.conf is under \search\local.
if you have timezone GMT+00:00, you have to use %:z, try:
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z
Bye.
Giuseppe
That didn't work It looks like it is pulling the time from the first part of the event.
I am doing these changes through the "Source Type" web interface, which updates props.conf when saved. Do I have to a restart of Splunk to get the changes to take?
I am running on a Windows server.
I did a restart this morning and the time is what I need it to be.
Thanks for the help.
Scott
Did you try increasing value for MAX_TIMESTAMP_LOOKAHEAD
?
Yes, it was 128 to start.
Did you try :
TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z
TIME_PREFIX = \|rt\=
MAX_TIMESTAMP_LOOKAHEAD = 160