topic Re: timezone question in Getting Data In

timezone question

a212830 — Mon, 28 Sep 2020 15:39:20 GMT

Hi,

I have a feed that sends messages using the UTC timezone. The timezone itself is never listed, but the vendor has assured me that this is the case (and it looks correct). Should I reference the timezone with a "TZ = UTC" in props.conf, or should I put a %T in the TIME_FORMAT, even though the timezone isn't in the message.

For example:

2014-01-14 23:54:17 1.2.3.4 message....

My props.conf has:

TIME_FORMAT = %Y-%m-%d %H:%M:%S
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TZ = UTC

or should it have:
TIME_FORMAT = %Y-%m-%d %H:%M:%S %T
SHOULD_LINEMERGE = false
TIME_PREFIX = ^

Update: it appears to be ignoring my timezone, regardless. As the event times are matching what is in the logs, and that should not be the case.

Re: timezone question

lukejadamec — Wed, 15 Jan 2014 02:45:45 GMT

What is your user default timezone? Splunk will adjust the search results based on the user timezone.
If no timezone is available in the event, then Splunk uses the indexer timezone. What is the indexer timezone?

Re: timezone question

lukejadamec — Wed, 15 Jan 2014 02:51:02 GMT

Try setting MAX_TIMESTAMP_LOOKAHEAD = 20 in your props.conf. That will keep Splunk from trying to interpret 1.2.3.4 as the TZ.