Splunk Search

Why am I unable to search data from firewall hosts unless I select "All Time" time range?

dnorman289
New Member

Splunk Version: 6.4.0
Splunk Build: f2c836328108

We collect data from Cisco Asa firewalls (5). We are able to search data from all the firewalls when I use the time parameter "all time" However when I try to use other time criteria like "last 7 days" or specific dates, the search doesn't work for one of the firewalls. The same search works if I use another firewall. The data is in the index however I don't get results unless I use "All Time"

Tags (2)
0 Karma
1 Solution

masonmorales
Influencer

Have you specified the time zone of your data in props.conf on either the heavy forwarder, or on the indexers (if you're using a universal forwarder)?

Take a look at the "TZ" parameter in props.conf

View solution in original post

0 Karma

masonmorales
Influencer

Have you specified the time zone of your data in props.conf on either the heavy forwarder, or on the indexers (if you're using a universal forwarder)?

Take a look at the "TZ" parameter in props.conf

View solution in original post

0 Karma

alemarzu
Motivator

Hi @dnorman289

Check your internals for a timestamp format related events, you will probably have to specifiy the timestamp format on your props.conf.

0 Karma

Richfez
SplunkTrust
SplunkTrust

What date and time are on the events when you use the "All Time" search? My guess is one of your 5 firewalls has the time off.

0 Karma

dnorman289
New Member

When I perform a tcpdump at the indexer I can see the data inbound to the server.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.