Support option auto_extract_timestamp=true in HEC url

[yoann-ls]

What is the sc4s version? 3.34.2

Feature Request description: When receiving logs from snare for Windows, the timestamp of the event may be different from the event in the syslog header. Therefore we must force the HEC to extract the timestamp at index time from the message and thus using the option in the HEC url:

/services/collector/event?auto_extract_timestamp=true

Adding an option in the configuration file to support this on per destination group, would solve the issuer.

The code to amend is the file conf.d/destinations/dest_hec/plugin.py and adding for the option: hec_endpoint_path = "/services/collector/event?auto_extract_timestamp=true"

[sbylica-splunk]

Wouldn't it make more sense to create a custom filter and extract it in SC4S? Alternatively we could try changing hec endpoint in values: charts/splunk-connect-for-syslog/values.yaml

[yoann-ls]

yes that would be a good alternative if we can do that

[chipzzz]

@yoann-ls , you can just set this in the helm chart. Append it to the splunk url you provide.

Do you find this to work though?

I have a props defined time extract and I cannot get splunk use index time for data come from splunk connect for syslog. I've tried this method without any luck. Is there any other hack to this ?

[sbylica-splunk]

@yoann-ls any updates to this case?