Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Splunk Search
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: timestamp in the beginning
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vinchakov_a
Path Finder
07-14-2015
11:34 PM
Why splunk adds the date and time to the beginning of a log. How to clean it?
Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:19 172.16.19.1 Jul 15 2015 10:27:19 us-fw01 : ...
Jul 15 09:27:18 172.16.19.1 Jul 15 2015 10:27:18 us-fw01 : ...
Jul 15 09:27:17 172.16.19.1 Jul 15 2015 10:27:17 us-fw01 : ...
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-16-2015
10:13 PM
Go to inputs.conf under where you define the input port, add:
no_appending_timestamp = true
From inputs.conf.spec documentation file:
no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-16-2015
10:13 PM
Go to inputs.conf under where you define the input port, add:
no_appending_timestamp = true
From inputs.conf.spec documentation file:
no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vinchakov_a
Path Finder
07-16-2015
10:37 PM
Thank you! It works
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-16-2015
11:13 PM
When you ask a question better, you get better answers!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-15-2015
07:10 AM
It will be nearly impossible to help you without MUCH more information. Is this coming in as Syslog? What is in your *.conf files?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vinchakov_a
Path Finder
07-16-2015
09:31 PM
Yes, this coming in as standard Syslog.
Get Updates on the Splunk Community!
Devesh Logendran, Splunk, and the Singapore Cyber Conquest
At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...
There's No Place Like Chrome and the Splunk Platform
WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...
Customer Experience | Join the Customer Advisory Board!
Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...
