topic Timezone issue in Splunk in Splunk Search

Timezone issue in Splunk

shashankk — Sat, 08 Jun 2024 18:33:16 GMT

Hi Team,

Need your assistance for the configuration changes in Splunk. The requirement is to change the Timezone based on different “source” (not sourcetype).

We have different sources defined in our application. All of them are in their respective server timezone, except for the below 2 sources (these 2 are in EST timezone & our requirement is to change it into CET timezone)

source=/applications/testscan/*/testscn01/* source=/applications/testscan/*/testcpdom/*

For rest of the other sources, I do not want make any change in the Timezone.

For example:

source=/applications/testscan/*/testscn02/* source=/applications/testscan/*/testnycus/* source=/applications/testscan/*/testnyus2/* source=/applications/testscan/*/testshape/* source=/applications/testscan/*/testshape2/* source=/applications/testscan/*/testshape3/*

Please note, we do not have any "props.conf" file available or configured in the server.

We are maintaining splunk configuration in only "inputs.conf" file. The present content of "inputs.conf" as below:

[monitor:///applications/testscan/.../] whitelist = (?:tools\/test\/log\/|TODAY\/LOGS\/)*\.(?:log|txt)$ index = testscan_prod sourcetype = testscan _TCP_ROUTING = in_prod [monitor:///applications/testscan/*/*/tools/test_transfer/log] index = testscan_prod sourcetype = testscan _TCP_ROUTING = in_prod [monitor:///applications/testscan/*/*/tools/test_reports/log] index = testscan_prod sourcetype = testscan _TCP_ROUTING = in_prod

Please suggest what changes to be done so that Timezone can be managed based on the "source" information provided.

@ITWhisperer

Re: Timezone issue in Splunk

inventsekar — Fri, 07 Jun 2024 16:52:17 GMT

Please note, we do not have any "props.conf" file available or configured in the server.

We are maintaining splunk configuration in only "inputs.conf" file.

Hi @shashankk .. more details pls..

is it a dev/test environment or prod..

do you have Deployment server or not..

any reasons for not having a props.conf and only having inputs.onf

that inputs.conf is on HF or indexer?... you use UF's or some applications send the logs to the monitored folders directly..

Re: Timezone issue in Splunk

richgalloway — Fri, 07 Jun 2024 16:59:41 GMT

Building on what @inventsekar said, it is strongly recommended that every sourcetype have a props.conf stanza. Splunk can guess about how to interpret your data, but using explicit instructions via props.conf is more performant. If you need to override default behavior, such as specifying a different time zone, props.conf is required.