Developing for Splunk Enterprise

Ingesting Cisco ISE logs - wrong timestamp

montgomeryam
Path Finder

Hello!

We are trying to track down issues with ingesting UDP syslog data from Cisco ISE in which it is being indexed in the wrong year timestamp. What I can see is that the events are often being collected as far back as 1986. I understand that we can utilize a props.conf to configure timestamp recognition on events that are missing identifiable timestamps.

Anyone else have this issue and were you able to fix it in props.conf?

Thanks!

Tags (1)
0 Karma
1 Solution

dkeck
Influencer

Did you try to use the TA for cisco ise? its for collecting ise syslog data
https://splunkbase.splunk.com/app/1915/#/overview

View solution in original post

0 Karma

dkeck
Influencer

Did you try to use the TA for cisco ise? its for collecting ise syslog data
https://splunkbase.splunk.com/app/1915/#/overview

View solution in original post

0 Karma

montgomeryam
Path Finder

No, but you gave me an awesome idea!

If we can't install the TA directly, we are a University and getting these installs takes some effort, then I will bust open the props.conf on the Cisco ISE TA and use those stanzas as first stab.

Thanks for sparking that idea!

0 Karma

dkeck
Influencer

Happy to help. It would be great if you could accept the answer 🙂

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!