Splunk issue when importing DLP logs due to a different date stamp in various logs
search cancel

Splunk issue when importing DLP logs due to a different date stamp in various logs

book

Article ID: 383347

calendar_today

Updated On:

Products

Data Loss Prevention

Issue/Introduction

A Splunk logging issue has been traced down to the timestamp format difference in two different DLP logs.  
Namely, the RequestProcessor.log and the Smtp_operational log.  
Is it possible to have both logs use the same timestamp formatting?

Formatting for Smtp_operational log is "two-digit day/three-character month/two-digit year". 
Example: 02/Dec/24

Formatting for RequestProcessor.log is "three-character month space two-digit day comma space four-digit year".
Example: Dec 2, 2024

Resolution

Engineering has confirmed that these is no way to modify the date/time stamp in our logs.

The Splunk team will need to create a separate parsing rule for each log file to accommodate the formatting difference.