Splunk timezone change for a specific sourcetye

kteng2024 — Tue, 29 Sep 2020 16:07:58 GMT

Hi,

I am using the timezone converting attribute " _tzhint" to convert EDT to UTC . This attribute was able to convert events timestamp to UTC but it is only converting only very few events, but not all. Below is the how configuration looks. when I use "TZ=UTC" splunk is not converting to UTC timezone , it is still using system time that is the reason I used _tzhint

[monitor:///web/appache.log]
disabled = false
followTail = 0
_tzhint=UTC
index = apache_web
sourcetype=web_logs

Re: Splunk timezone change for a specific sourcetye

bsriramineni_sp — Tue, 29 Sep 2020 16:12:54 GMT

"_tzhint"needs to be removed. It is not a documented feature and it was only used in splunk STORM which was the precursor to Cloud. It is NOT supported. So it won't change the logs timestamp.

Analyse your logs and set proper values for the below parameters in props.conf file.

[web_logs]
TIME_PREFIX = link text
MAX_TIMESTAMP_LOOKAHEAD = link text
TIME_FORMAT = link text
TZ = UTC

The above configuration should fix this issue.

For more details, refer the below links:

http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf#Timestamp_extraction_configuration

http://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps

http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Configurepositionaltimestampextraction

topic Re: Splunk timezone change for a specific sourcetye in Getting Data In

Splunk timezone change for a specific sourcetye

Re: Splunk timezone change for a specific sourcetye