How to Avoid Prepending Timestamps and Host Fields to Events When Splunk Receives Syslog Data on UDP port

Applicability

Description

Splunk recommends using the Splunk Connect for Syslog (SC4S)  to configure network inputs for syslog data. This solution simplifies the otherwise complex task of safely onboarding syslog data. However, in some scenarios, you might need to configure syslog ingestion without relying on SC4S.

When an intermediate syslog server collects syslog data from source hosts and forwards it to Splunk indexers, the events may have their timestamps and host fields overwritten by the intermediate server’s hostname and the data reception time. This behaviour occurs due to how Splunk handles syslog inputs by default.

Investigation

When you configure a UDP network input to listen to a syslog-standard data stream on Splunk Enterprise or the universal forwarder, any syslog events that arrive through the input receive a timestamp and connected host field. The platform prepends these fields to each event before it indexes them. When you configure a universal forwarder to send data to Splunk Cloud Platform, Splunk Cloud Platform indexes the fields as it receives them from the universal forwarder.

For example, if the event received on the UDP port is:

<13> IP-0ACA0DBC 02-04-2025 06:49:43.836 +0000 log message

The priority will be stripped and a timestamp and connected host added to the event so that the indexed event will be:

Feb  4 06:49:44 10.202.13.188 IP-0ACA0DBC 02-04-2025 06:49:43.836 +0000 log message

Resolution

To prevent Splunk from prepending the timestamp and host fields to the event, configure the no_appending_timestamp attribute in the inputs.conf file. Set this attribute to true to disable the default behaviour. 

no_appending_timestamp = <boolean>
* Whether or not to append a timestamp and host to received events.
* A value of "true" means the instance does NOT append a timestamp
and host to received events.
* NOTE: Do NOT set this setting if you want to append timestamp and host
to received events.
* Default: false

For Example, the following will prevent the timestamp and host from being prepended to the syslog events received on UDP port 514:

$SPLUNK_HOME/etc/system/local/inputs.conf

[udp://514]
sourcetype = syslog
no_appending_timestamp = true

With no_appending_timestamp = true configured, if the event received on the UDP port is:

<13> IP-0ACA0DBC 02-04-2025 06:49:43.836 +0000 log message

The Indexed event will be:

IP-0ACA0DBC 02-04-2025 06:49:43.836 +0000 log message

Related Links

inputs.conf.spec

How the Splunk platform handles syslog inputs