topic Re: How to convert UTC to CST in Getting Data In

How to convert UTC to CST

martinnepolean — Tue, 08 Oct 2019 14:18:15 GMT

We are receiving events on our syslog collector in UTC timezome. Below is the sample event.

I have configured the below props on our search head, My assumption was it will pick the searchhead timezone while showing the events in SH.but it is not converting the timezone to CT

[sourcetype]
DATETIME_CONFIG = CURRENT

Oct  8 13:59:00 x.x.x.x [Audit] User xxxxlogged in on the web GUI interface.

Re: How to convert UTC to CST

ivanreis — Wed, 09 Oct 2019 00:09:32 GMT

Please try this one at props.conf using the host

[host::server_sourcename]
TZ = US/Central

OR by source

[source::your_source]
TZ = US/Central

OR by sourcetype

[sourcetype::your_sourcetype]
TZ = US/Central

For further information, please check this document: https://answers.splunk.com/answers/135193/splunk-indexing-and-time-zone-normalization.html

Re: How to convert UTC to CST

martinnepolean — Wed, 30 Sep 2020 02:31:06 GMT

No ivanreis, it didnt work, below is my props file content

source = /opt/syslog_ng/logs/xxx//-xxx.log

[source::/opt/syslog_ng/logs/xxx/*/*xxx.log]
TZ = US/Central

Re: How to convert UTC to CST

ivanreis — Fri, 11 Oct 2019 00:33:27 GMT

Where you are deploying this configuration?
In order to have this configuration work properly, the props.conf have to be deployed at the indexer or heavy forwarder tier to parse the timezone properly before indexing, if you are not running on a Splunk standalone instance. Use the btool to troubleshoot your configuration.

https://docs.splunk.com/Documentation/Splunk/7.3.2/Troubleshooting/Usebtooltotroubleshootconfigurations

Re: How to convert UTC to CST

woodcock — Sun, 20 Oct 2019 22:17:02 GMT

I am not sure exactly what problem you have but if you read these posts, you will have all of the understanding necessary to get what you need:
https://answers.splunk.com/answers/494692/display-user-specific-timezone-in-dasboard.html
https://answers.splunk.com/answers/590067/how-do-i-map-my-personally-tz-adjusted-time-to-ano.html
https://answers.splunk.com/answers/241990/does-splunk-take-into-consideration-timezone-dayli.html
https://answers.splunk.com/answers/408167/query-for-different-timezones.html

Re: How to convert UTC to CST

martinnepolean — Wed, 30 Sep 2020 02:48:59 GMT

I have deployed them on indexers, I have created a new app for props file and deployed yo all index peers. But still, the time conversion is not happening.

[source::/opt/syslog_ng/logs/xxx/*/*xxx.log]
TZ = US/Central