Splunk Search

timestamp in the beginning

vinchakov_a
Path Finder

Why splunk adds the date and time to the beginning of a log. How to clean it?

Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:19 172.16.19.1 Jul 15 2015 10:27:19 us-fw01 : ...
Jul 15 09:27:18 172.16.19.1 Jul 15 2015 10:27:18 us-fw01 : ...
Jul 15 09:27:17 172.16.19.1 Jul 15 2015 10:27:17 us-fw01 : ...
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

View solution in original post

woodcock
Esteemed Legend

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

vinchakov_a
Path Finder

Thank you! It works

0 Karma

woodcock
Esteemed Legend

When you ask a question better, you get better answers!

0 Karma

woodcock
Esteemed Legend

It will be nearly impossible to help you without MUCH more information. Is this coming in as Syslog? What is in your *.conf files?

0 Karma

vinchakov_a
Path Finder

Yes, this coming in as standard Syslog.

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...