topic Re: Checkpoint logs being indexed incorrectly ( One hour earlier ) in Getting Data In

Checkpoint logs being indexed incorrectly ( One hour earlier )

LeandroKopke — Thu, 07 Nov 2019 19:12:35 GMT

I am having trouble with my checkpoint log.
Or indefinite is late hour.

Example:
Actual time of the event: 12:15.
Time that is indexed on spunk: 11:15: AM

Time at checkpoint is correct. Splunk time is ticking. Already added in props.conf the checkpoing or sourcetype [opsec] and put the parameter
TZ = America / Sao_Paulo, but I have the wrong indexing

Re: Checkpoint logs being indexed incorrectly ( One hour earlier )

jacobpevans — Thu, 07 Nov 2019 20:01:38 GMT

The past weekend was daylight savings changeover. Are you certain all your timezones are set properly? Is the clock on the indexer(s) accurate?

Re: Checkpoint logs being indexed incorrectly ( One hour earlier )

LeandroKopke — Thu, 07 Nov 2019 20:05:54 GMT

Hi Jacob.
Yes. I'm check all indexers.

Re: Checkpoint logs being indexed incorrectly ( One hour earlier )

somesoni2 — Thu, 07 Nov 2019 20:50:42 GMT

Where have you put the props.conf for TZ setting for opsec sourcetype, Indexer/Intermediate Forwarder OR at universal forwarder where you're monitoring the log file?

Re: Checkpoint logs being indexed incorrectly ( One hour earlier )

LeandroKopke — Thu, 14 Nov 2019 19:50:56 GMT

A TZ configuration was used in the indexer. This server has the OPSEC LEA app and all configuration is all made on it.