topic What makes difference timezone on same sourcetype by two Heavy Forwarder in Getting Data In

What makes difference timezone on same sourcetype by two Heavy Forwarder

michael_wong — Fri, 21 Jun 2024 08:16:11 GMT

Deleted

richgalloway — Wed, 09 Jun 2021 13:02:39 GMT

That the two HFs use the same indexer and SH has no bearing on this problem. The HFs are parsing the logs independently.

Please share sample events for the zscalerapi-zia-audit sourcetype from each HF.

Are the props.conf settings installed on both HFs?

michael_wong — Wed, 09 Jun 2021 14:05:09 GMT

Very helpful. The problem was I put the props.conf in indexer instead of HF. After move the conf to HF, the issue was solved.

Thank you for your help.

michael_wong — Wed, 09 Jun 2021 14:07:44 GMT

I want to make your post as a solution, but seems click the wrong button.

Sorry for that.

richgalloway — Wed, 09 Jun 2021 15:32:03 GMT

I changed it.