topic How to edit props.conf to adjust the default UTC timestamp? in Getting Data In

How to edit props.conf to adjust the default UTC timestamp?

Hegemon76 — Tue, 23 Aug 2016 18:56:10 GMT

Hello,

I'm trying to adjust this raw data seen below. Our office is EST and the FireEye appliance is BST, but the test alerts I'm generating are coming in UTC. I've looked all over the place to change this:

8/23/16 
2:09:48.000 PM  
<162>fenotify-3386.crit: CEF:0|FireEye|MPS|7.8.1.468932|MC|malware-callback|7|rt=Aug 23 2016 18:04:23 UTC

I made a props.conf in the local directory for the search app and put this inside but it doesn't seem to be working either.

[fe_alert]
TIME_PREFIX = ^\d+\w+
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%BST
MAX_TIMESTAMP_LOOKAHEAD = 28

Any help would be appreciated.

Thank You

Re: How to edit props.conf to adjust the default UTC timestamp?

diogofgm — Tue, 23 Aug 2016 21:30:03 GMT

You can use TZ atribute
from props.conf docs

TZ = <timezone identifier>
* The algorithm for determining the time zone for a particular event is as
  follows:
* If the event has a timezone in its raw text (for example, UTC, -08:00),
  use that.
* If TZ is set to a valid timezone string, use that.
* If the event was forwarded, and the forwarder-indexer connection is using
  the 6.0+ forwarding protocol, use the timezone provided by the forwarder.
* Otherwise, use the timezone of the system that is running splunkd.
* Defaults to empty.

I would suggest, if possible, using a forwarder on the other location so anything that comes from there, like your appliancedata, gets the proper time and you don't need to set it in the sourcetype stanza.

Re: How to edit props.conf to adjust the default UTC timestamp?

Hegemon76 — Tue, 23 Aug 2016 21:40:22 GMT

Thanks for your response but you obviously copied and pasted whats in the props.conf documentation....I've already looked at that....

Re: How to edit props.conf to adjust the default UTC timestamp?

Hegemon76 — Tue, 23 Aug 2016 22:57:21 GMT

At this point I would settle for using an eval command to change my time 8/23/16 6:50:17.000 PM to BST

Is that even possible?