Splunk Search

How do I extract the time from Operating System events?

scottrunyon
Contributor

I am trying to extract the time from event from the AV system. The output is set up to be sent to Splunk over UDP every 15 minutes. Splunk is setting _time as the download time, not the time of the event.

This is the format of the message -

Apr 12 07:04:00 10.00.00.00 Apr 12 2018 07:04:00 system.corp.net CEF:0|AV System|Manager System|2.2|444444|Device Access Control|3|rt=Apr 12 2018 11:53:17 GMT+00:00 cs1Label=Product_Entity/Endpoint

I have tried the following

TIMESTAMP_FIELDS = rt
TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%z
TIME_PREFIX = rt=
MAX_TIMESTAMP_LOOKAHEAD = 160

What am I missing?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex

TIME_PREFIX = rt\=

and

MAX_TIMESTAMP_LOOKAHEAD = 31

and I shouldn't use

TIMESTAMP_FIELDS = rt

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex

TIME_PREFIX = rt\=

and

MAX_TIMESTAMP_LOOKAHEAD = 31

and I shouldn't use

TIMESTAMP_FIELDS = rt

Bye.
Giuseppe

0 Karma

scottrunyon
Contributor

That did not work. The events are showing Time as the download time.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi scottrunyon,
do you receive these logs on Indexer or on Heavy Forwarder?
where is this props.conf?
It must be on the same server that receive logs.

Bye.
Giuseppe

0 Karma

scottrunyon
Contributor

It is received on the indexer. I have a single instance and props.conf is under \search\local.

0 Karma

gcusello
SplunkTrust
SplunkTrust

if you have timezone GMT+00:00, you have to use %:z, try:

TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z

Bye.
Giuseppe

0 Karma

scottrunyon
Contributor

That didn't work It looks like it is pulling the time from the first part of the event.

0 Karma

scottrunyon
Contributor

I am doing these changes through the "Source Type" web interface, which updates props.conf when saved. Do I have to a restart of Splunk to get the changes to take?

I am running on a Windows server.

0 Karma

scottrunyon
Contributor

I did a restart this morning and the time is what I need it to be.

Thanks for the help.

Scott

0 Karma

p_gurav
Champion

Did you try increasing value for MAX_TIMESTAMP_LOOKAHEAD ?

0 Karma

scottrunyon
Contributor

Yes, it was 128 to start.

0 Karma

p_gurav
Champion

Did you try :

TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z
TIME_PREFIX = \|rt\=
MAX_TIMESTAMP_LOOKAHEAD = 160
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...