All Apps and Add-ons

Wrong timestamp in Splunk for Palo Alto Network logs

johan_ryberg
Engager

Hi,

I'm sending syslog from my PAN device to splunk and it's indexed with a date stating 2010 instead of 2014.

Both index server and PAN device are using Europe/Stockholm and if I tcpdump traffic it's looks OK.

But then I'm searching in splunk they all are dated 2010.

Could someone point me in the correct direction how to fix this?

Tnx

// Johan

1 Solution

btorresgil
Builder

Hello,

Usually the clock or timezone is wrong on the Splunk server or firewall, but since you checked that, you're probably missing the "no_appending_timestamp = true" in your inputs.conf. Make sure the inputs.conf entry looks something like this:

[udp//5514]
connection_host = ip
index = pan_logs
sourcetype = pan_log
no_appending_timestamp = true

Here is a guide on configuring and troubleshooting the app:

https://live.paloaltonetworks.com/docs/DOC-6593

Please let us know if that fixes the issue. Thanks!

View solution in original post

btorresgil
Builder

Hello,

Usually the clock or timezone is wrong on the Splunk server or firewall, but since you checked that, you're probably missing the "no_appending_timestamp = true" in your inputs.conf. Make sure the inputs.conf entry looks something like this:

[udp//5514]
connection_host = ip
index = pan_logs
sourcetype = pan_log
no_appending_timestamp = true

Here is a guide on configuring and troubleshooting the app:

https://live.paloaltonetworks.com/docs/DOC-6593

Please let us know if that fixes the issue. Thanks!

ditty77
Explorer

Hi!

 

I tried adding this line to my inputs.conf -> no_appending_timestamp = true

but I am still seeing logs come in to splunk with the UTC time even though the log itself shows a central timestamp.

0 Karma

johan_ryberg
Engager

Yes, that was the problem. I thought I had no_appending_timestamp = true in the file but it was missing.

Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...