topic How can i change timestamp?(Moscow Timezone inexactness) in Getting Data In

How can i change timestamp?(Moscow Timezone inexactness)

andrey2007 — Mon, 28 Sep 2020 13:12:57 GMT

Hello,
i have Splunk on freebsd 8.2 and i collect logs from Cisco Ips with Splunk for Cisco IPS App(using scripted input). Trouble is in timestamps, if event occurs at present moment, i see this event on splunk through some seconds, but with timestamp like this event was one hour ago. On freebsd i have Moscow timezone and correct time, time on Ips corresponds to realtime too, but in Splunk (Manager=>Your account) Moscow timezone is UTC+3, but really Moscow timezone is UTC+4. This is a problem. How can i change timestamps? Or may be somebody knows another solution for this problem.
P.s. i tryed to change props.conf for this app, may be i forgot something? this is my props.conf
[source::/opt/splunk/etc/apps/Splunk_CiscoIPS/var/log/ips_sdee.log.192.22.97.82]
[cisco_ips_syslog]
TZ = AE

Re: How can i change timestamp?(Moscow Timezone inexactness)

yannK — Thu, 31 Jan 2013 16:57:40 GMT

"Moscow timezone is UTC+3, but really Moscow timezone is UTC+4"
the timezone definition comes from your system TZ tables, double check that your system is up to date on the indexers and search-heads. see in /usr/share/zoneinfo/

on linux you can try any timezone conversion of the current time with
date; export TZ=AE; date

Re: How can i change timestamp?(Moscow Timezone inexactness)

andrey2007 — Thu, 31 Jan 2013 17:09:26 GMT

Yes, my system is up to date and with correct time, for testing i have one Splunk instance.