Splunk Search

timestamp in the beginning

vinchakov_a
Path Finder

Why splunk adds the date and time to the beginning of a log. How to clean it?

Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:19 172.16.19.1 Jul 15 2015 10:27:19 us-fw01 : ...
Jul 15 09:27:18 172.16.19.1 Jul 15 2015 10:27:18 us-fw01 : ...
Jul 15 09:27:17 172.16.19.1 Jul 15 2015 10:27:17 us-fw01 : ...
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

View solution in original post

woodcock
Esteemed Legend

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

vinchakov_a
Path Finder

Thank you! It works

0 Karma

woodcock
Esteemed Legend

When you ask a question better, you get better answers!

0 Karma

woodcock
Esteemed Legend

It will be nearly impossible to help you without MUCH more information. Is this coming in as Syslog? What is in your *.conf files?

0 Karma

vinchakov_a
Path Finder

Yes, this coming in as standard Syslog.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...