timestamp in the beginning

[vinchakov_a]

Why splunk adds the date and time to the beginning of a log. How to clean it?

Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:19 172.16.19.1 Jul 15 2015 10:27:19 us-fw01 : ...
Jul 15 09:27:18 172.16.19.1 Jul 15 2015 10:27:18 us-fw01 : ...
Jul 15 09:27:17 172.16.19.1 Jul 15 2015 10:27:17 us-fw01 : ...

[woodcock · Accepted solution]

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

[vinchakov_a]

Thank you! It works

[woodcock]

When you ask a question better, you get better answers!

[woodcock]

It will be nearly impossible to help you without MUCH more information. Is this coming in as Syslog? What is in your *.conf files?

[vinchakov_a]

Yes, this coming in as standard Syslog.