Hi,
I'm sending syslog from my PAN device to splunk and it's indexed with a date stating 2010 instead of 2014.
Both index server and PAN device are using Europe/Stockholm and if I tcpdump traffic it's looks OK.
But then I'm searching in splunk they all are dated 2010.
Could someone point me in the correct direction how to fix this?
Tnx
// Johan
Hello,
Usually the clock or timezone is wrong on the Splunk server or firewall, but since you checked that, you're probably missing the "no_appending_timestamp = true
" in your inputs.conf. Make sure the inputs.conf entry looks something like this:
[udp//5514]
connection_host = ip
index = pan_logs
sourcetype = pan_log
no_appending_timestamp = true
Here is a guide on configuring and troubleshooting the app:
https://live.paloaltonetworks.com/docs/DOC-6593
Please let us know if that fixes the issue. Thanks!
Hello,
Usually the clock or timezone is wrong on the Splunk server or firewall, but since you checked that, you're probably missing the "no_appending_timestamp = true
" in your inputs.conf. Make sure the inputs.conf entry looks something like this:
[udp//5514]
connection_host = ip
index = pan_logs
sourcetype = pan_log
no_appending_timestamp = true
Here is a guide on configuring and troubleshooting the app:
https://live.paloaltonetworks.com/docs/DOC-6593
Please let us know if that fixes the issue. Thanks!
Hi!
I tried adding this line to my inputs.conf -> no_appending_timestamp = true
but I am still seeing logs come in to splunk with the UTC time even though the log itself shows a central timestamp.
Yes, that was the problem. I thought I had no_appending_timestamp = true in the file but it was missing.
Thanks