topic Re: Setting timezone is not working in Getting Data In

Setting timezone is not working

strive — Mon, 28 Sep 2020 16:41:08 GMT

Hi,

We are using Splunk 6.0.3

The host (no matter where it is located) always sends logs with UTC time. In my props.conf file i have added TZ = UTC in the stanza that processes the logs. But still i see the _time as forwarder's time zone.

My Props.conf looks like this:

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)\d{2}-[a-zA-Z]{3}-\d{4}\s\d{2}:\d{2}:\d{2}\s

MAX_TIMESTAMP_LOOKAHEAD=20

TIME_PREFIX=^

TIME_FORMAT=%d-%b-%Y %H:%M:%S

TZ=UTC

Thanks

Strive

Re: Setting timezone is not working

lukejadamec — Mon, 28 Sep 2020 16:41:13 GMT

Splunk will set event time zones according to the following priority:

1) It will use the time zone in the raw event data.

2) It will use the time zone in props.conf

3) If both the forwarder and indexer are 6.0 or later, then it used the time zone of the forwarder.

In your case, the time zone of the event is UTC because the time zone is included in the event.

However, because your MAX_TIMESTAMP_LOOKAHEAD is set to 20, Splunk never sees the time zone so it can't apply it.

I’m not sure why it does not check props.conf before it moves on to the third priority. Perhaps the props.conf is in the wrong location?

Regardless, change your MAX_TIMESTAMP_LOOKAHEAD to 30.

Re: Setting timezone is not working

strive — Wed, 21 May 2014 20:48:30 GMT

Thanks for your response. props.conf is inside /IndexAPP/local/ directory. This splunk app is added to peer nodes (indexers).

Note: we use clusters

Re: Setting timezone is not working

strive — Wed, 23 Jul 2014 02:03:25 GMT

The issue was with forwarder. It is resolved.

Re: Setting timezone is not working

jdhruti — Wed, 07 Jun 2017 02:34:06 GMT

what's was the issue? we are having the same issue where the timezone is set as UTC, but it still indexes data in EDT.