Splunk Search

timestamp in the beginning

Path Finder

Why splunk adds the date and time to the beginning of a log. How to clean it?

Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:19 172.16.19.1 Jul 15 2015 10:27:19 us-fw01 : ...
Jul 15 09:27:18 172.16.19.1 Jul 15 2015 10:27:18 us-fw01 : ...
Jul 15 09:27:17 172.16.19.1 Jul 15 2015 10:27:17 us-fw01 : ...
Tags (3)
0 Karma
1 Solution

Esteemed Legend

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

View solution in original post

Esteemed Legend

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

View solution in original post

Path Finder

Thank you! It works

0 Karma

Esteemed Legend

When you ask a question better, you get better answers!

0 Karma

Esteemed Legend

It will be nearly impossible to help you without MUCH more information. Is this coming in as Syslog? What is in your *.conf files?

0 Karma

Path Finder

Yes, this coming in as standard Syslog.

0 Karma