topic Re: Yet more timezone excitement in Getting Data In

Yet more timezone excitement

sseekamp — Thu, 01 May 2014 01:57:37 GMT

I have logs with a timezone specified like:

2014 Apr 30 20:37:31:001 GMT -5

There is a space between the GMT and the -5. Splunk is picking this up as GMT instead of US/Central.

How can I override or define the TZ as the entire "GMT -5" string?

Thanks!

Re: Yet more timezone excitement

richgalloway — Thu, 01 May 2014 12:52:04 GMT

You could put a TIME_FORMAT string in your props.conf file, but I think that won't work because the offset is not in the expected 'hhmm' format. Try overriding the timezone by putting TZ=-05:00 in the relevant props.conf stanza.

Re: Yet more timezone excitement

somesoni2 — Thu, 01 May 2014 13:55:22 GMT

Add following to your props.conf

[YourSourceType]
TIME_FORMAT=%Y %b %d %H:%M:%S:%3Q %Z %z  
....
.other settings..
.....

Re: Yet more timezone excitement

sseekamp — Mon, 16 Jun 2014 04:31:37 GMT

Thanks - this was perfect!