Other Usage

Missing date, time and host in logs from sc4s

Adpafer
Loves-to-Learn Everything

Hi there,

Logs sent to SC4S include date, time and host in the event, however when they are sent to Indexer, the date, time and host are missing. How can I get them back so the logs will look exactly the same?

sc4s.jpgindexer.jpg

I would like date, time and host included in the event.

I appreciate any hints.

thanks and regards, pawelF

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You need to look at how the input is processed and the definition of inputs.conf/props.conf for that linux sourcetype.

As you can see in that event example, the time in the log message is 15:04:57, but the time in the Splunk event is 15:03:57, i.e. a minute earlier - so that date is not the one being used when Splunk is ingested.

I am not familiar with SC4S, but has someone written a parser for that data - if so, it may be that the issue is at the SC4S parsing end.

 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...