IIS FTP LOG TIMEZONE PROBLEM

jscnet — Wed, 28 Mar 2012 18:45:43 GMT

Using IIS FTP Server, Server 2008 RC2. FTP log format is W3C (UTC Timestamps). Splunk pulls the logs (entries) in just fine, however the time is wrong, that is, there's no conversion from UTC to US/Pacific.

I've looked on this forum and Google and tried modifying the /etc/system/local/props.conf file in the following way (btw: splunk is also running on Windows Server 2008 RC2):

[iis_ftp]
TZ = Etc/UTC

[iis]
TZ = Etc/UTC

AND ...

[sourcetype::iis_ftp]
TZ = Etc/UTC

[sourcetype::iis]
TZ = Etc/UTC

Neither works, no conversion to US/Pacific (or my local timezone). I of course restarted splunk after modifying props.conf. I've looked at the following:

http://splunk-base.splunk.com/answers/9666/iis-log-timezone
http://splunk-base.splunk.com/answers/1425/timezones-iis-w3c-extended-logging-why-dont-they-work
http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/ApplyTimezoneOffsetstotimestamps
http://splunk-base.splunk.com/answers/28442/log-time-differs-from-time-on-splunk-host

This to me should be an obvious no-brainer and a VERY common topic. Perhaps I've misread something in those articles -- just doesn't work. Any solutions? Thanks, J.

Re: IIS FTP LOG TIMEZONE PROBLEM

jscnet — Wed, 28 Mar 2012 18:48:20 GMT

Using Splunk version 4.2.3

Re: IIS FTP LOG TIMEZONE PROBLEM

ziegfried — Wed, 28 Mar 2012 19:08:15 GMT

Have you tried using:

TZ = UTC

Re: IIS FTP LOG TIMEZONE PROBLEM

yannK — Wed, 28 Mar 2012 19:16:04 GMT

are not IIS logs ALWAYS in GMT ?

Re: IIS FTP LOG TIMEZONE PROBLEM

jscnet — Wed, 28 Mar 2012 22:07:20 GMT

Thanks @Ziegfried. That worked.

Re: IIS FTP LOG TIMEZONE PROBLEM

DominikW — Thu, 28 Apr 2022 11:28:44 GMT

Worked here also! Thank you!

topic Re: IIS FTP LOG TIMEZONE PROBLEM in Getting Data In

IIS FTP LOG TIMEZONE PROBLEM

Re: IIS FTP LOG TIMEZONE PROBLEM

Re: IIS FTP LOG TIMEZONE PROBLEM

Re: IIS FTP LOG TIMEZONE PROBLEM

Re: IIS FTP LOG TIMEZONE PROBLEM

Re: IIS FTP LOG TIMEZONE PROBLEM