topic Re: Where to convert GMT for cluster? in Getting Data In

Where to convert GMT for cluster?

jwalzerpitt — Thu, 22 Oct 2020 20:29:26 GMT

I installed the Splunk Add-On for AWS on my HF and created an input with a custom data type to ingest the AWS instance logs (basically Linux and Windows event logs), with a custom sourcetype of aws:s3:hostOS, but the problem is when I search the logs the timestamps are showing up as +4. I'm EST and the OS logs are GMT.

Do I need to modify the props.conf on my HF to adjust for GMT, or on the SH cluster, or on both the HF and SH cluster?

Thx

Re: Where to convert GMT for cluster?

richgalloway — Thu, 22 Oct 2020 20:47:05 GMT

It could be the TIME_FORMAT is not correct to the time zone is not detected correctly or maybe the TZ attribute needs to be added.

Please share the props.conf settings for the aws:s3:hostOS sourcetype. Please also share some example events so we can see what the timestamps look like.

Re: Where to convert GMT for cluster?

jwalzerpitt — Thu, 22 Oct 2020 22:20:13 GMT

Rich,

Thx for the reply.

The input I had to use was the custom data type that does not have a corresponding stanza in props.conf.

I was seeing events as follows with timestamps a few hours ahead:

Oct 22 22:10:01 ip-X-X-X-X systemd: Stopping User Slice of root.

I created a props.conf file in the local dir of the add-on on my HF and added the following stanza:

[aws:s3:hostOS] TZ = GMT

and now when I run a search the timestamps are as follows:

Oct 22 22:13:06 ip-x-x-x-x dhclient[3010]: XMT: Solicit on eth0, interval 127130ms.

I believe this fixed the issue

Thx