topic Re: How to manage _time field with schedule change in Europe zone ? in Splunk ITSI

How to manage _time field with schedule change in Europe zone ?

mah — Tue, 27 Oct 2020 09:52:25 GMT

Hi,

With the time change, my logs are shifted by one hour (logs from an HEC input) :

It is the same case on many logs from several sources.

Like logs from Azure add-on (the props is correctly set with a TIME_PREFIX on the field Horodate) :

And same case from other add-on...

How can I fix this ?

Thank you!

richgalloway — Tue, 27 Oct 2020 13:42:53 GMT

What is the TIME_FORMAT setting in props.conf?

Is the system clock correct? What time zone does the system use?

mah — Tue, 27 Oct 2020 14:26:23 GMT

Actually, I have this issue on many logs.

What is the TIME_FORMAT setting in props.conf?

Example of props.conf for the two pictures below :

[sourcetype_picture1]

SHOULD_LINEMERGE = false

LINE_BREAKER = ([\r\n]+)

TRUNCATE = 999999

TIME_PREFIX = \"\@timestamp\"\:

[sourcetype_picture2]
SHOULD_LINEMERGE = 0
category = Splunk App Add-on Builder
pulldown_type = 1
INDEXED_EXTRACTIONS = json
TIME_PREFIX = Horodate

This both example worked good until the schedule change on Sunday.

Is the system clock correct?

Actually I did not find a TZ by default for the system.

This TZ parameter is set on some apps like add-on splunk but sometime it is UTC and sometime it is GMT .

What time zone does the system use?

I did not find a TZ by default for the system.