https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-timezone-to-prevent-events-from-appearing/m-p/277930#M53261 <P>I have a light forwarder listening on tcp:514. It forwards data to three indexers, all of whose clocks are set to UTC time.</P> <P>Several Cisco WSA proxy appliances are sending logs to the light forwarder. The WSAs don't support UTC time, so they are in US/Pacific and in Ireland.</P> <P>Their syslog events arrive on tcp:514. A props/transforms identifies those events and changes the sourcetype to cisco:wsa:squid. It then routes that data to the "cisco" index rather than the "syslog" index.</P> <P>The events are showing up in Splunk as being eight hours behind the present time.</P> <P>I have tried:</P> <PRE><CODE>[source::tcp:514] TZ = US/Pacific [cisco:wsa:squid] TZ = US/Pacific [host::10.10.10.10] TZ = US/Pacific </CODE></PRE> <P>And none of these work... I've also tried America/Los_Angeles, PDT, and PST. I feel like I'm taking crazy pills... what am I doing wrong?</P> Mon, 12 Dec 2016 23:41:05 GMT responsys_cm 2016-12-12T23:41:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-timezone-to-prevent-events-from-appearing/m-p/277930#M53261 <P>I have a light forwarder listening on tcp:514. It forwards data to three indexers, all of whose clocks are set to UTC time.</P> <P>Several Cisco WSA proxy appliances are sending logs to the light forwarder. The WSAs don't support UTC time, so they are in US/Pacific and in Ireland.</P> <P>Their syslog events arrive on tcp:514. A props/transforms identifies those events and changes the sourcetype to cisco:wsa:squid. It then routes that data to the "cisco" index rather than the "syslog" index.</P> <P>The events are showing up in Splunk as being eight hours behind the present time.</P> <P>I have tried:</P> <PRE><CODE>[source::tcp:514] TZ = US/Pacific [cisco:wsa:squid] TZ = US/Pacific [host::10.10.10.10] TZ = US/Pacific </CODE></PRE> <P>And none of these work... I've also tried America/Los_Angeles, PDT, and PST. I feel like I'm taking crazy pills... what am I doing wrong?</P> Mon, 12 Dec 2016 23:41:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-timezone-to-prevent-events-from-appearing/m-p/277930#M53261 responsys_cm 2016-12-12T23:41:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-timezone-to-prevent-events-from-appearing/m-p/277931#M53262 <P>Hi, this is a format for props.conf I have used before, it might help.</P> <P># Props.conf</P> <P>[source::udp]<BR /> NO_BINARY_CHECK = true<BR /> SHOULD_LINEMERGE = false<BR /> TRUNCATE = false<BR /> MAX_TIMESTAMP_LOOKAHEAD = 20<BR /> TIME_FORMAT = %b %d %H:%M:%S<BR /> TZ = America/Chicago</P> <H1>set the host as from the incoming udp packet</H1> <P>TRANSFORMS-gethostfromdata = set_host</P> Tue, 29 Sep 2020 12:04:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-the-timezone-to-prevent-events-from-appearing/m-p/277931#M53262 mrgibbon 2020-09-29T12:04:05Z