topic TZ offset in props.conf not working in Getting Data In

TZ offset in props.conf not working

conorglynn — Mon, 28 Sep 2020 09:54:51 GMT

My splunk forwarders are light forwarders, so I am setting my timezone offset for my web servers with the following on my splunk indexer, in my default app si_idx (/opt/splunk/etc/apps/si_idx/default/props.conf) I place the following:

[host::web*]
TZ = UTC

My web servers are logging in UTC, the event data is as follows:
10:53:24.699

2011-09-27 10:53:24,699 [27] DEBUG SPIN.Wholesale.Presentation.BL.Managers.ChannelRequestManager Channel d3ffba61-0f1a-4e4f-8536-24593a89090b requested at: 27/09/2011 10:53:24

and I wish the splunk timestamp to be one hour later (Europe/London).
The entry in props.conf above does not work when I restart splunk, the splunk timestamp is still in UTC. Where am I going wrong?
thanks, conor

Re: TZ offset in props.conf not working

conorglynn — Tue, 27 Sep 2011 16:17:23 GMT

We have managed to sort out the times on our log4j clients at source, but I am still having problems getting the IIS logs to offset correctly, I have placed the following in props.conf on the Indexer but it having no effect:

[IIS]
TZ = UTC

does anybody have any info on getting IIS logs to offset to the correct Timezone on the indexer?

Re: TZ offset in props.conf not working

richnavis — Tue, 27 Sep 2011 17:13:29 GMT

We do it by source which works fine..
[source::\\SERVERNAME\prod-iislogs\...\...\u_ex*.log]
TZ = GMT

Re: TZ offset in props.conf not working

conorglynn — Wed, 28 Sep 2011 10:22:56 GMT

thanks rnavis,
yes, I changed to setting the TZ by source in props.conf and it works just fine, for some reason the same thing did not work by host or sourcetype for me.
anyway, all well now, thanks, conor

Re: TZ offset in props.conf not working

vcarbona — Wed, 22 May 2013 17:12:00 GMT

After trial and error, it seems to work when I specify it without any spaces and then restart the indexer. Using $SPLUNK_HOME/etc/system/local/props.conf in 4.3.6 version:

[source::*\\mydata\\Log*]
TZ=UTC

Re: TZ offset in props.conf not working

yuvalba — Sun, 16 Nov 2014 16:58:20 GMT

I seem to be having the same issue. Setting TZ via [host::myhost] is not affecting while using the [source::mysource] is working. Were you able to get it to work using a host stanza?
PS. I am using Splunk 5.0.10

Re: TZ offset in props.conf not working

sloshburch — Sun, 16 Nov 2014 17:51:07 GMT

I noticed the same thing in splunk 6.1* flavors. I recall it was even reproducible while defining the sourcetype in the data inputs UI. If not done already, I would encourage you to create a support ticket. It's possible this is not a known issue.

Re: TZ offset in props.conf not working

tskinnerivsec — Tue, 26 May 2015 20:36:22 GMT

Thank you, I was just banging my head on a data source with TZ command, I usually match on sourcetype and typically it works, in this case it did not (I think due to the fact that I was overriding the sourcetype field) matching this field on source did the trick for me.

Re: TZ offset in props.conf not working

ejenson_splunk — Thu, 13 Jul 2017 03:06:18 GMT

This is still an issue in version 6.5.2. If the sourcetype is defined in inputs and not reassigned in props/transforms it works fine.

Re: TZ offset in props.conf not working

esalesapns2 — Wed, 13 Nov 2019 21:41:42 GMT

I'm having the same issue in 7.3.2. System is logging in US/Eastern, Splunk is UTC. My props is based on source. Applied it on HF, and Indexer, no change to time setting.