topic Re: change extracted event timezone in Getting Data In

change extracted event timezone

davidepala — Sat, 10 Feb 2018 22:59:19 GMT

Hi guys
i've a scritpt on a linux forwarder to monitor a load balancer, it's log is a txt file in UTC format, i need to set the time zone to europe/rome, to do this i've setup props.conf on indexer as show below

[source::NSowa]
TZ = Europe/Rome

the result is the same

as you can see event without timestam are logged with the correct time, the time extraction is wrong.

Re: change extracted event timezone

micahkemp — Sun, 11 Feb 2018 00:38:48 GMT

Consult the documentation for instruction on setting the timezone correctly.

Re: change extracted event timezone

davidepala — Sun, 11 Feb 2018 15:15:28 GMT

i've read the documentation, I read about the TZ parameter there ... where i'm wrong?

Re: change extracted event timezone

ddrillic — Sun, 11 Feb 2018 15:28:19 GMT

Based on this screen-shot, these two events don't seem be of source = NSowa. You see, source is not listed below the event, only host...

Re: change extracted event timezone

micahkemp — Sun, 11 Feb 2018 16:32:41 GMT

My apologies, I didn't see the props.conf snippet you posted. I read this as a general "how do I use TZ in Splunk" question. @ddrillic's comment seems to identify at least one issue with this configuration.

Re: change extracted event timezone

davidepala — Sun, 11 Feb 2018 22:49:06 GMT

tnx ddrillic, the source is correct, i don't know why but i've hosted a new screenshot on imgur but the forum don't show it ... i've post a new reply in the main thread with screenshot

Re: change extracted event timezone

davidepala — Sun, 11 Feb 2018 22:50:51 GMT

here is the screenshot with source as selected field

Re: change extracted event timezone

klopez30 — Mon, 12 Feb 2018 23:06:19 GMT

I downvoted this post because this isn't a very helpful comment. telling someone to just read the documentation doesn't help someone find what they're looking for to become better.

Re: change extracted event timezone

micahkemp — Tue, 13 Feb 2018 00:40:32 GMT

As I responded in a previous comment, it seemed to be a general "how do I configure timezones to work" question. As such, I linked to the documentation in my answer.

Re: change extracted event timezone

493669 — Tue, 13 Feb 2018 03:21:29 GMT

We should not be trying to discourage people from posting answers..down votes are for completely wrong answers/bad advice

Re: change extracted event timezone

micahkemp — Tue, 13 Feb 2018 03:47:43 GMT

I get the reasoning behind the downvote. I think it's the type of post that should potentially be downvoted (when it an answer is purposely unhelpful, etc). In this case I simply misunderstood the question, and apologized to the asker prior to the downvote.

When I posted the answer, a pointer to the correct documentation seemed like the best place to start, due to my missing the details in the question about already having attempted to implement the configs.

All in all, it was a reasonable consideration to downvote.

Re: change extracted event timezone

davidepala — Tue, 13 Feb 2018 15:20:18 GMT

Solved .... the time zone must be the TZ of the SOURCE .... in my case W3C log are always UTC, using TZ = UTC i've solved the problem