Getting Data In

Why are a timestamp and hostname prepended to my UDP input events?

Jason
Motivator

I have Splunk listening to a handful of UDP ports for different types of syslog data. All events that come in, in addition to a timestamp and hostname in the event already, are being prepended by another timestamp and a hostname or IP.

The timestamp can be far off from the actual event, and appears to be the indexer's time(zone), where the event could be generated by a device on the other side of the globe.

This is messing with my TZ settings. How do I tell Splunk to stop doing this?

1 Solution

Jason
Motivator

This is a default behavior of Splunk, for UDP inputs. To turn off, in the appropriate inputs.conf file, under the appropriate [udp://...] stanza, add no_appending_timestamp = true.

View solution in original post

Jason
Motivator

This is a default behavior of Splunk, for UDP inputs. To turn off, in the appropriate inputs.conf file, under the appropriate [udp://...] stanza, add no_appending_timestamp = true.

Jason
Motivator

I see - I have noticed this. It has never been a problem before, but four of the five client UDP inputs have their own hostname and timestamp that messes with TZ settings because the stamp is always local.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This is a default behavior of all syslog servers, including syslogd, rsyslog, and syslog-ng. Syslog devices usually do not generate timestamps or hostnames when the message is transmitted. The timestamps and hostnames in syslog files created by syslog server daemons are usually prepended by the server daemon when received.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...