Splunk Search

double date in log

supernana
New Member

recently i notice log send by my switch to splunk is indexed by double date & time format, my switch date and my splunk date. for example

Oct 18 01:12:36 172.16.12.6 Oct 18 01:11:36 SW-NUS1-LT12A SW-NUS1-LT12A: last message repeated 66 times

as far i remember when i first install splunk it didnt format like this, thx

Tags (1)
0 Karma

supernana
New Member

it doesnt work, still the same, strangely it only happen to my juniper ex switch

0 Karma

Ayn
Legend

From inputs.conf documentation:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Inputsconf

0 Karma

supernana
New Member

the log i see in my splunk server is like this

Oct 18 01:12:36 172.16.12.6 Oct 18 01:11:36 SW-NUS1-LT12A SW-NUS1-LT12A: last message repeated 66 times

Which is if you see it have double date "Oct 18 01:12:36 172.16.12.6 Oct 18 01:11:36" data,
as far i remember when i first install splunk the log is only have one timestamp

0 Karma

bmacias84
Champion

@supernana, I am not sure what your question is?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...