Splunk Search

timestamp in the beginning

vinchakov_a
Path Finder

Why splunk adds the date and time to the beginning of a log. How to clean it?

Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:20 172.16.19.1 Jul 15 2015 10:27:20 us-fw01 : ...
Jul 15 09:27:19 172.16.19.1 Jul 15 2015 10:27:19 us-fw01 : ...
Jul 15 09:27:18 172.16.19.1 Jul 15 2015 10:27:18 us-fw01 : ...
Jul 15 09:27:17 172.16.19.1 Jul 15 2015 10:27:17 us-fw01 : ...
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

View solution in original post

woodcock
Esteemed Legend

Go to inputs.conf under where you define the input port, add:

no_appending_timestamp = true

From inputs.conf.spec documentation file:

no_appending_timestamp = [true|false]
* If this attribute is set to true, Splunk does NOT append a timestamp and host to received events.
* NOTE: Do NOT include this attribute if you want to append timestamp and host to received events.
* Default is false.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.spec

vinchakov_a
Path Finder

Thank you! It works

0 Karma

woodcock
Esteemed Legend

When you ask a question better, you get better answers!

0 Karma

woodcock
Esteemed Legend

It will be nearly impossible to help you without MUCH more information. Is this coming in as Syslog? What is in your *.conf files?

0 Karma

vinchakov_a
Path Finder

Yes, this coming in as standard Syslog.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...