topic Re: Cisco Network App and Search & Reporting App Time Difference in Splunk Search

Cisco Network App and Search & Reporting App Time Difference

splunkot — Sat, 23 Feb 2019 03:21:15 GMT

With no TZ configured, my Search & Reporting App is displaying the correct time (UTC-10:00 or 13:00 HST) but, my Cisco Networks App is displaying a time 10 hours ahead (23:00 HST) of our local time.

When I edit the props.conf in the TA-cisco_ios folder, I enter "TZ = UTC" under the syslog stanza, now the display time is correct (13:00 HST) for the Cisco Network App, but now the Search & Reporting App is displaying a time 10 hours behind (03:00 HST) our local time.

I tried editing both props.conf in the TA-cisco_ios and search App folders with no success.

All of my event logs' time are correct, so how do I get both Cisco Network and Search & Reporting App to display the correct time?

Re: Cisco Network App and Search & Reporting App Time Difference

lakshman239 — Sat, 23 Feb 2019 22:40:00 GMT

I assume your search head, indexers are configured with your local time or UTC. What's the time zone configuration in the Cisco IOS devices? If they are in a different timezone, the app/add-on would convert/parse them correctly and send data to your indexer to index in correct timezone. Pls check the props.conf to see if they are matching the TZ of the IOS devices.

Re: Cisco Network App and Search & Reporting App Time Difference

splunkot — Mon, 25 Feb 2019 19:46:52 GMT

I have "clock timezone HST -10" configured on my Cisco IOS devices. My Splunk instance is configured with my local time. I searched all apps\system local props.conf for "TZ" and the only TZ configured is for the TA-cisco_ios app.

Re: Cisco Network App and Search & Reporting App Time Difference

splunkot — Wed, 13 Mar 2019 00:30:02 GMT

I am not sure why but, the problem corrected itself after deploying:

Splunk App for Windows Infrastructure
Splunk Add-on for Microsoft Windows
Splunk Supporting Add-on for Microsoft Windows Active Directory

Now my Cisco Networks Overview and Search and Reporting display time are both UTC-10.

Re: Cisco Network App and Search & Reporting App Time Difference

splunkot — Wed, 13 Mar 2019 20:04:15 GMT

To confirm, I removed Splunk App for Windows Infrastructure, Splunk Add-on for Microsoft Winows, and Splunk Supporting Add-on for Microsoft Windows Active Directory and the display time for the Cisco Networks Overview and Search and Reporting are still UTC-10.

The display time issue may have been resolved from the recent Splunk 7.2.4.2 update.

Re: Cisco Network App and Search & Reporting App Time Difference

woodcock — Sun, 28 Apr 2019 07:00:13 GMT

You need to go to <Your Login Here> -> Preferences -> Time zone and set it to your preferred value so that Splunk knows how to translates times to suit your location.