topic Re: Get source machine timezone in events in Getting Data In

Get source machine timezone in events

Vikas_Sharma — Wed, 06 Sep 2017 21:00:52 GMT

Is there a way (if possible) to stamp the time zone of the machine running universal forwarder in the events (Windows eventlogs)? Both our indexers and UFs are on V6 and we get the source machine timestamp in Splunk. We are interested in getting the source machine timezone which can be helpful if we plan to forward the data to third party apps.

Re: Get source machine timezone in events

woodcock — Wed, 06 Sep 2017 21:37:41 GMT

Splunk supplies you with what it interpreted the TZ to be for each event in the date_zone field. If this value is local, then the TZ of the indexing server (in the splunk_server field) was used.

Re: Get source machine timezone in events

Vikas_Sharma — Wed, 06 Sep 2017 21:54:14 GMT

Thank you for the response.

The date_zone field is empty for the events. How can I set it up? Is it by using TZ in local/props.conf on the indexer, I tried it but it never worked (tried with [source::*] and [] as well).

[host::]
TZ=US/Eastern

Re: Get source machine timezone in events

woodcock — Wed, 06 Sep 2017 23:36:19 GMT

This means that they came in from a modular input and it was probably timestamped with the the time that it was indexed or it was a WinEventLog:* and I don't know what those timestamps do.