topic how to change timezone for splunk-add-onn for google cloud platform in Getting Data In

how to change timezone for splunk-add-onn for google cloud platform

jjofret — Wed, 14 Jul 2021 18:31:20 GMT

hi, please i would like to ask for help to determine how to convert the timezone of events i am indexing with the gcp cloud plattform add-on before they are indexed. Events arrive today in UTC, and I need to convert that time to gmt-4. I have been trying from the sourcetype configuration, without success. I was also seeing this link, without much success

https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Applytimezoneoffsetstotimestamps

Re: how to change timezone for splunk-add-onn for google cloud platform

codebuilder — Thu, 15 Jul 2021 21:22:32 GMT

When you say you need to convert that time, what do you mean exactly?

Events are stored using UTC at index time. At search time Splunk uses the time zone set on the Splunk instance (default time zone), unless a given user has changes that.

I think the latter is what you are after is displaying the correct time when searching. For this you don't need any conversion, just go to your user preferences and change your time zone to GMT. Splunk will then automatically adjust the results for you.

Re: how to change timezone for splunk-add-onn for google cloud platform

jjofret — Fri, 16 Jul 2021 16:58:00 GMT

Hi, this problem was resolved with this article:

https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Configuretimestamprecognition

thanks so much

Re: how to change timezone for splunk-add-onn for google cloud platform

andrewcg — Tue, 14 Sep 2021 21:27:44 GMT

We are in EST and all data from Google in in UTC, so all of our data was four hours off:

index=<your gcp index> | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | eval delta = _indextime - _time | table sourcetype, _time, _indextime, indextime, delta | sort indextime desc

sourcetype _time indextime delta

google:gcp:pubsub:message	2021-09-14 21:13:45.381	2021-09-14 17:13:48	-14397.381004
google:gcp:pubsub:message	2021-09-14 21:13:47.272	2021-09-14 17:13:47	-14400.272801
google:gcp:pubsub:message	2021-09-14 21:13:46.430	2021-09-14 17:13:47	-14399.43

jofret, is this the change you made? Edit file /opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/local/props.conf

[google:billing:json] TZ = UTC [google:billing:csv] TZ = UTC [google:gcp:billing:report] TZ = UTC [google:gcp:pubsub:message] TZ = UTC [google:gcp:pubsub:audit:auth] TZ = UTC [google:gsuite:pubsub:audit:auth] TZ = UTC [google:gcp:gsuite:admin:directory:users] TZ = UTC [google:gcp:buckets:xmldata] TZ = UTC [google:gcp:buckets:jsondata] TZ = UTC [google:gcp:buckets:*data] TZ = UTC [google:gcp:compute:instance] TZ = UTC [google:gcp:compute:vpc_flows] TZ = UTC

After refreshing the heavy forwarder this Splunk add is running on the the issue seems to be resolved.

sourcetype _time indextime delta

google:gcp:pubsub:message	2021-09-14 17:20:38.147	2021-09-14 17:20:39	0.852020
google:gcp:pubsub:message	2021-09-14 17:20:38.146	2021-09-14 17:20:39	0.853950
google:gcp:pubsub:message	2021-09-14 17:20:38.097	2021-09-14 17:20:39	0.902150