hi,
I'm using the 'fw log -l -n -p ' command to dump some old firewall logs to text to get them into splunk 4.1.x. Splunk doesn't seem to want to parse the event dates correctly and I think it is ending up using the timestamp from the text file itself. The date and time in each event can look like:
' 1Jan2011 0:00:09 ...rest of event'
' 1Jan2011 20:00:09 ...'
'11Jan2011 0:00:09 ...'
'11Jan2011 20:00:09 ...'
Notice the space at the start of the event sometimes and there is also either a single or double space between the date and the time.
How can I teach splunk to recognise this date time stamp?
If Splunk doesn't recognize those timestamps, use the following in props.conf:
[checkpoint]
TIME_FORMAT=%e%b%Y %k:%M:%S
Set your sourcetype to "checkpoint" and this will teach Splunk to recognize the timestamps.
By the way, there are Check Point apps posted here, if you want LEA integration: http://splunkbase.splunk.com/apps/All/4.x/app:OPSEC+LEA+for+Check+Point+(Linux) http://splunkbase.splunk.com/apps/All/4.x/app:OPSEC+LEA+for+Check+Point+(Solaris)
If Splunk doesn't recognize those timestamps, use the following in props.conf:
[checkpoint]
TIME_FORMAT=%e%b%Y %k:%M:%S
Set your sourcetype to "checkpoint" and this will teach Splunk to recognize the timestamps.
By the way, there are Check Point apps posted here, if you want LEA integration: http://splunkbase.splunk.com/apps/All/4.x/app:OPSEC+LEA+for+Check+Point+(Linux) http://splunkbase.splunk.com/apps/All/4.x/app:OPSEC+LEA+for+Check+Point+(Solaris)
Thanks that worked. Note that the Splunk docs for TIME_FORMAT refer to strptime() man pages but it is doesn't have a %k. The strftime() man pages do.