Splunk Search

what can be done to keep the past in the past?

raomu
Explorer

Hello,

For the past couple of weeks, we’ve seen events from the past being recently indexed. I assume that these few of the boxes were just powered up, and because of the forwarding infrastructure, that these are “current” events?
what can be done to keep the past in the past?

Thanks.

Tags (1)
0 Karma

MousumiChowdhur
Contributor

Hi @raomu,

You can keep the configuration DATETIME_CONFIG = blank in props.conf instead of setting it to CURRENT or NONE that will consider the timestamp of the event.

For your reference https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf

Thanks. Let me know if that helps.

0 Karma

MousumiChowdhur
Contributor

Hi, If you have used crcSalt = <SOURCE> from your inputs.conf then you should remove that if you your files get rotated after a certain time duration. Setting crcSalt in such case will cause re-indexing of your data.

Thanks!

0 Karma

raomu
Explorer

Thanks for your reply, but here the issue is not related to re-indexing.

My bad, may be I should have put more information.

Example :

we have some server X , Y

and these 2 servers have log files with year old data.

I installed the fwd and start getting logs from these 2 machines. Now the issue is the logs which is already associated with old or last year time stamps when indexed In spunk will take current time.

example :

event 03/06/017 xyzzy .......... login attempt.

during the index time it will take the current time not the actual event time.

So do we have any way of these types of events already indexed we can setup the indexed time same as event time ?

0 Karma

MousumiChowdhur
Contributor

Hi, do you have a single source from where data is coming or multiple sources?

0 Karma

raomu
Explorer

single source.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...