topic Re: universal forwarder - set timezone in Getting Data In

universal forwarder - set timezone

jhallman — Mon, 28 Sep 2020 09:49:35 GMT

Forwarder is in US/Pacific and splunk indexer is in EST. Where do I need to set the timezone so _time has the correct time when I search for events.

Example..logfile tmp/SQL_IO_Write_stats.sigsfpip1.run.log looks likes this (right now it runs 10min after the hour) and logs the IO for each DB into this file.

Aug 23 2011 04:10PM 5 HALO 113326168 103536 14318436352 66323611648 00000000000007a8 1

Aug 23 2011 04:10PM 7 Matrics 78072770 54788 7857946624 41943040000 00000000000007a0

[default]
host = myhost
[monitor:///tmp/SQL_IO_Write_stats.sigsfpip1.run.log]
crcSalt =
disabled = false
followTail = 0
index = db_stats
sourcetype = db_stats

on searches host="myhost"
_time shows

8/23/11 4:00:00.000 AM

Re: universal forwarder - set timezone

reynard082 — Thu, 01 Sep 2011 15:17:55 GMT

I also have that same question, is it better to do the TZ on the universal forwarder, the indexer, or the search head?

Re: universal forwarder - set timezone

rroberts — Thu, 01 Sep 2011 15:23:49 GMT

Check out this document:
http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F

Re: universal forwarder - set timezone

lguinn2 — Sat, 03 Sep 2011 17:59:00 GMT

For timezone, you do not have a choice; for some other settings, you do. You must set the timezone where the parsing occurs. See this definitive answer from S Sorkin. I second rroberts recommendation of the Where do I configure my Splunk settings?