ProxySG UTC+2 issue, recommended config

ojay — Thu, 06 May 2021 11:35:27 GMT

Hi all,

I'm new to this forum. Would be really happy if you could help me with this.

I am ingesting Bluecode ProxySG logs via syslog as recommended with the log format configuration provided by splunk.

 $(date)T$(x-bluecoat-hour-utc):$(x-bluecoat-minute-utc):$(x-bluecoat-second-utc).000z $(s-computername) bluecoat - splunk_format

https://docs.splunk.com/Documentation/AddOns/released/BlueCoatProxySG/Setup

The event time of a proxySG event is always showed with UTC +2 which is causing Splunk to not recognize the time.

Can keep the format configuration and set the ProxySG to local time to avoid the UTC? Will this configuration still be working and simply not just showing +2?

Regards,

topic ProxySG UTC+2 issue, recommended config in Getting Data In

ProxySG UTC+2 issue, recommended config