Hi, all,
I'm trying to ingest pcap files using Splunk Stream with the config shown below.
[streamfwd]
streamfwdcapture.0.interface = /tmp/pcap/
streamfwdcapture.0.offline = true
streamfwdcapture.0.sysTime = false
Although pcap ingestion itself is successful, the record timestamps are not actual ones from pcap files, and the system time seems to be used instead. (To me, streamfwdcapture.0.sysTime in the conf does not properly work).
Does anyone have the same experience, and any solutions?
Below is the environment I tried
- Splunk 7.3.6
- Splunk Stream 7.2.0
