topic Re: Splunk index event with incorrect timezone in Getting Data In

Splunk index event with incorrect timezone

mrteen2010 — Tue, 27 Apr 2021 09:28:10 GMT

I have the following props configuration:

[log_files] SHOULD_LINEMERGE = false NO_BINARY_CHECK = true TRUNCATE = 0 KV_MODE = true pulldown_type = true TRANSFORMS_FIELDS = data,time TIME_FORMAT = %Y-%m-%d %H:%M:%S

My log files contains IIS logs as follow:

2020-01-22 12:00:37 ::1 GET /test - 80 ::1 Mozilla/5.0+(Windows+NT+6.1;+Win64; x64;+rv:47.0)+Gecko/20100101+Firefox/47.0 - 200 2 5 100

Splunk indexing this file with incorrect time, I got event with time 15:00:07 instead 12:00:37 (and I see another field date_zone=-180), How can I make splunk index event with original the time from the logs file?

NOTE: I don't know the logs timezone .

Re: Splunk index event with incorrect timezone

s2_splunk — Tue, 27 Apr 2021 17:37:47 GMT

Please consult the documentation here and the linked information at the bottom of the page to understand how Splunk assigns timezones if the event timestamp in itself does not contain a TZ qualifier.

You would need to at least know what the source logs' timezone is to properly configure things...

Re: Splunk index event with incorrect timezone

mrteen2010 — Wed, 28 Apr 2021 07:24:47 GMT

Hi,

It isn't possible simply make splunk to take the original event time from log file without TZ converting??

Thanks for your answer!

Re: Splunk index event with incorrect timezone

s2_splunk — Wed, 28 Apr 2021 15:45:34 GMT

A timestamp in a global context isn't complete without a timezone reference. You can get away without specifying any timezones if you ensure all your systems are set to log in the same timezone (e.g. UTC), which is what a lot of organizations do.

In the absence of this, either timestamps need to have an embedded timezone offset, or you can explicitly set the timezone a timestamp was generated in when configuring your sources.

Not having timestamps properly represented can cause issues with indexing (out of order events) and search (time-based correlation), so you want to make sure that every timestamp has a timezone context.

Alternatively, you may choose to simply use the time an event was indexed as the event timestamp.