topic Re: Timezone Offset in Getting Data In

Timezone Offset

carmackd — Thu, 17 Feb 2011 06:49:57 GMT

Can this configuration be made on the forwarder, or must it be placed on the indexer?

props.conf:

[host::nyc*] 
TZ = US/Eastern

Re: Timezone Offset

Stephen_Sorkin — Thu, 17 Feb 2011 06:53:20 GMT

It must be placed on the server that's parsing the data. If it's a heavyweight forwarder, it goes on the forwarder. If it's a light forwarder, it goes on the indexer.

Re: Timezone Offset

pj — Fri, 18 Feb 2011 02:20:34 GMT

So, if we have a mix of 1000s of heavy and lightweight forwarders, we cant just stick the TZ for each host in the props.conf on the indexers?

We have to identify the heavy forwarders and ensure they have this set in their local props.conf on each heavy forwarder (an arduous task in our environment)?

Re: Timezone Offset

gfriedmann — Sat, 26 Feb 2011 00:58:23 GMT

Yes. I believe this is a shortcoming of splunk at the moment. I have run into this problem with windows light forwarders, but i don't even have a hostname convention method to help deal with local timezone settings. We run servers that must be configured in the audience's timezone.

Re: Timezone Offset

clabu — Mon, 28 Sep 2020 14:43:55 GMT

I am using Splunk Universal Forwarder 4.3.2 on Windows sending IIS logs to a Splunk 4.3.2 server on CentOS. I had to add the timezone to /opt/splunk/etc/system/local/props.conf on the server:

[iis]
TZ = GMT

[iis-1]
TZ = GMT

The events ended up having sourcetype [iis-1] on the server because of CHECK_FOR_HEADER being enabled on the forwarder (http://splunk-base.splunk.com/answers/72860/sourcetypes-keep-on-multiplying/72883), hence the two stanzas.

Re: Timezone Offset

Lowell — Thu, 17 Apr 2014 17:39:18 GMT

Starting in Splunk 6, it's now possible to specify the timezone on a Universal Forwarder. As long as both sender and receiver are using the new forwarding protocol, the timezone information provided by the sender should be honored.

Links to related docs:

Specify time zones of timestamps
props.conf - Look at the "TZ" attribute.
outputs.conf. The new protocol can be enabled/disabled with negotiateNewProtocol.