topic Re: How to handle multiple timezone when getting the paloalto firewall logs in? in Getting Data In

How to handle multiple timezone when getting the paloalto firewall logs in?

Iris_Pi — Mon, 19 Aug 2024 09:37:58 GMT

Hello Guys,

We have paloalto firewalls with different timezone settings. For the ones which is not in the same timezone as Splunk, their logs will be considered as the logs of the future and hence cannot be searched in Splunk in a timely manner.

I cannot fix it by specifying timezone for the source types provided by the paloalto TA, since it cannot fulfill multiple time zones at the same time.

I wonder if you have experienced the similar problem, if yes, would you please share your experience on handling this kind of issue?

Thanks much for your help in advance!

Regards,
Iris

Re: How to handle multiple timezone when getting the paloalto firewall logs in?

KendallW — Tue, 20 Aug 2024 01:19:44 GMT

Hi @Iris_Pi would it be feasible to specify the time zone using source stanzas in props.conf instead of sourcetype in this case? [source::] takes precedence over [<sourcetype>] in props.conf.

Re: How to handle multiple timezone when getting the paloalto firewall logs in?

Iris_Pi — Tue, 20 Aug 2024 01:41:00 GMT

Thanks much for your reply!
I'm checking with the support if they can help to set props.conf on the backend, since we are using splunk cloud.

Re: How to handle multiple timezone when getting the paloalto firewall logs in?

Iris_Pi — Tue, 20 Aug 2024 06:42:38 GMT

Hello @KendallW,

Can you please help on a follow up question? In my case, I'm using HEC to get the logs in, the "source::" spec cannot distinguish the firewalls, can I use "host::" instead?

Re: How to handle multiple timezone when getting the paloalto firewall logs in?

Iris_Pi — Wed, 21 Aug 2024 08:59:25 GMT

My problem was solved by creating a private app with a customized props.conf file, which defines different TZ for different hosts like showed as below:

[host::hostA]
TZ = xxx

[host::hostB]
TZ = xxx

Re: How to handle multiple timezone when getting the paloalto firewall logs in?

KendallW — Thu, 22 Aug 2024 05:57:17 GMT

Hi @Iris_Pi , yes, as per the documentation:

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

Re: How to handle multiple timezone when getting the paloalto firewall logs in?

PickleRick — Thu, 22 Aug 2024 07:27:08 GMT

One caveat though - the host field might be being parsed out from the raw message during ingestion. In such case you can't use it for specifying props stanza.