topic Re: how do I skip the timezone inside the timestamps in Getting Data In

how do I skip the timezone inside the timestamps

cyue_splunk — Mon, 24 Dec 2012 03:45:06 GMT

I got a sample log with timestamp format like this:

Thu Dec 20 20:45:24 CST 2012

The CST here means China Standard Time (+8). But Splunk recognize this time zone as US Central Time(-6), so the event timestamp I got is Dec 21 10:45:24 am (with my local system also in +8 timezone). No matter how I set the Timeformat in props.conf to skip the CST timezone, the timestamp won't change. Any idea how I can fix this timezone issue?

Re: how do I skip the timezone inside the timestamps

Damien_Dallimor — Mon, 28 Sep 2020 13:00:42 GMT

In props.conf you can specify the time format that you want applied to your event timestamps.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition#Edit_timestamp_properties_in_props.conf

Can you post the strptime pattern you are specifying..maybe it has an error ?

Re: how do I skip the timezone inside the timestamps

cyue_splunk — Mon, 24 Dec 2012 04:15:31 GMT

I used this:
TIME_FORMAT = %b %d %H:%M:%S \w+ %Y

Re: how do I skip the timezone inside the timestamps

cyue_splunk — Mon, 24 Dec 2012 04:56:07 GMT

I actually also tried to resort the "timezone" with the "year" as described here, but the result won't change.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition#Reconfigure_how_timestamps_appear_in_raw_data

My current workaround is to modify the datetime.xml to remove the CST from the zone list.

Re: how do I skip the timezone inside the timestamps

cyue_splunk — Mon, 24 Dec 2012 05:31:34 GMT

This is the correct one. Thanks, Damien!

TIME_FORMAT = %b %d %H:%M:%S CST %Y