Splunk Search

How do I extract the time from Operating System events?

Contributor

I am trying to extract the time from event from the AV system. The output is set up to be sent to Splunk over UDP every 15 minutes. Splunk is setting _time as the download time, not the time of the event.

This is the format of the message -

Apr 12 07:04:00 10.00.00.00 Apr 12 2018 07:04:00 system.corp.net CEF:0|AV System|Manager System|2.2|444444|Device Access Control|3|rt=Apr 12 2018 11:53:17 GMT+00:00 cs1Label=Product_Entity/Endpoint

I have tried the following

TIMESTAMPFIELDS = rt
TZ = America/Chicago
TIME
FORMAT = %b %d %Y %H:%M:%S %Z%z
TIMEPREFIX = rt=
MAX
TIMESTAMP_LOOKAHEAD = 160

What am I missing?

0 Karma
1 Solution

Legend

Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex

TIME_PREFIX = rt\=

and

MAX_TIMESTAMP_LOOKAHEAD = 31

and I shouldn't use

TIMESTAMP_FIELDS = rt

Bye.
Giuseppe

View solution in original post

0 Karma

Legend

Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex

TIME_PREFIX = rt\=

and

MAX_TIMESTAMP_LOOKAHEAD = 31

and I shouldn't use

TIMESTAMP_FIELDS = rt

Bye.
Giuseppe

View solution in original post

0 Karma

Contributor

That did not work. The events are showing Time as the download time.

0 Karma

Legend

Hi scottrunyon,
do you receive these logs on Indexer or on Heavy Forwarder?
where is this props.conf?
It must be on the same server that receive logs.

Bye.
Giuseppe

0 Karma

Contributor

It is received on the indexer. I have a single instance and props.conf is under \search\local.

0 Karma

Legend

if you have timezone GMT+00:00, you have to use %:z, try:

TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z

Bye.
Giuseppe

0 Karma

Contributor

That didn't work It looks like it is pulling the time from the first part of the event.

0 Karma

Contributor

I am doing these changes through the "Source Type" web interface, which updates props.conf when saved. Do I have to a restart of Splunk to get the changes to take?

I am running on a Windows server.

0 Karma

Contributor

I did a restart this morning and the time is what I need it to be.

Thanks for the help.

Scott

0 Karma

Champion

Did you try increasing value for MAX_TIMESTAMP_LOOKAHEAD ?

0 Karma

Contributor

Yes, it was 128 to start.

0 Karma

Champion

Did you try :

TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z
TIME_PREFIX = \|rt\=
MAX_TIMESTAMP_LOOKAHEAD = 160
0 Karma