topic Re: Overriding timezone in props.conf in Getting Data In

Overriding timezone in props.conf

howyagoin — Sat, 07 May 2011 05:28:54 GMT

Hi,

I'm trying to get Splunk to recognise my timezone based on a TZ and TIME_PREFIX setting in props.conf. However, it seems to get overridden by the presence of a timezone in the event line.

My props.conf:


[wireshark-test3]
TZ=Australia/Sydney
TIME_PREFIX = \s+Arrival\sTime:
LINE_BREAKER = ([\r\n]+)([\r\n]+)
BREAK_ONLY_BEFORE = ^Frame

Example data:

Frame 4397: 917 bytes on wire (7336 bits), 917 bytes captured (7336 bits)
    Arrival Time: May  7, 2011 12:38:46.463639654 EST
    Epoch Time: 1304735926.463639654 seconds
    [Time delta from previous captured frame: 0.020186528 seconds]
    [Time delta from previous displayed frame: 0.088711321 seconds]

...

My props.conf correctly breaks down events, however, it sees the "EST" and assumes that is US/Eastern Standard Time, not Australian Eastern Standard Time.

Is this fixable in props.conf, or am I going to have to add something to transforms.conf to get this to work correctly?

At the moment it's reading in the data and assuming the US value, which of course breaks things...

Re: Overriding timezone in props.conf

gkanapathy — Sat, 07 May 2011 18:22:24 GMT

If you want to ignore the time zone in the event, you should set TIME_FORMAT to something without the time zone, possibly:

TIME_FORMAT = %b %d, %Y %H:%M:%S.%9N

But since you have the epoch time, it might be better to avoid the time zone issue completely and just use:

TIME_PREFIX = Epoch Time:
TIME_FORMAT = %s.%9N
MAX_TIMESTAMP_LOOKAHEAD = 24

Also (nothing to do with your question), your linebreaking/linemerge rules, while correct, would be more efficient as:

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=Frame)

Re: Overriding timezone in props.conf

howyagoin — Sun, 08 May 2011 22:15:47 GMT

Brilliant, thanks, that did it. And thanks for the more efficient way of doing the linebreaking!