About mbozbura

DanielPi · ‎04-15-2024

Hi @mbozbura, I’m a Community Moderator in the Splunk Community. This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!

mbozbura · ‎01-28-2021

Hi, I created my custom input (mytest.conf.tmpl) by coping the /opt/sc4s/local/config/log_paths/lp-example.conf.tmpl. When I send following event to SC4S from port 5144, timestamp is extracted as attach "1/28/21 4:31:30.000 PM" . I see that timestamp is extracted by adding three hours to this (Jan 28 13:21:30 ) However when I read from file mytest123.log, as you can see timestamp is extracted correctly 1:21:27 PM. props.conf for mytest123.log [sc4s:forcepoint] TIME_PREFIX= \srt= MAX_TIMESTAMP_LOOKAHEAD=15 How can I extract timestamp correctly? Thanks, Converted 13 digit epoch time = Thursday, January 28, 2021 1:21:27 PM GMT+03:00 "<13> Jan 28 13:35:04 myhost vendor=myvendor product="My xx Security" version=9.9.9 event=Message dvc=111.111.111.111 dvchost=myhost rt=1611829287000 externalId=999999900000000 messageId=mmmmm suser="abcd@xxx.com" duser="aa.bb@xxxx.com " msg="MY Event""

Posts	2
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎10-15-2020

Online Status	Offline
Date Last Visited	‎04-16-2024 11:07 AM

SC4S Timestamp Extraction for Custom Inputs

Re: Splunk Enterprise security Custom Threat intel...

SC4S Timestamp Extraction for Custom Inputs