All Apps and Add-ons

wrong time in last connected OPSEC LEA

bhanu22
Engager

In the OPSEC LEA LOGGRABBER APP for checkpoint the time shown in "last connected" is incorrect.
I have the Splunk server running in UTC while I access the Splunk Web interface to create the connection from Singapore it shows me the last connected time in SGT but with future time.
That is SGT is UTC + 8 so the last connected shown in SGT should be local time of Singapore but however the last connected shown to me is UTC + 16 i.e. SGT + 8, hence the OPSEC LEA app is showing me last connected time incorrect. I have confirmed Splunk server, Checkpoint CMA, Gateway and provider-1 all are running in UTC.
Can some one please help me in this issue, I have gone through the Splunk configs no where I have configured any custom timezones, its set to use the local server time.

1 Solution

amarsaroj
Explorer

Checkpoint App Version: 1.11.1

This issue is seen when the server where the checkpoint app is setup (usually forwarder) and the user location viewing the 'Manage Connections' fall in different timezone.

Looks like the ajax script controlling the opsec app, is calculating the Date() incorrectly. The Date function which operates on 'data.last_time' (which is epoch time of last connection time) is using the offset parameter unnecessarily. Removing the offset solved the issue.

AJAX file location: $app path/appserver/static/opsec.js';
function: getConnInfo()

EDIT:
d = new Date(data.last_time*1000 - offset);

TO:
d = new Date(data.last_time*1000);

Note: Removal of the browser cache maybe required for the changes to take effect.

View solution in original post

amarsaroj
Explorer

Checkpoint App Version: 1.11.1

This issue is seen when the server where the checkpoint app is setup (usually forwarder) and the user location viewing the 'Manage Connections' fall in different timezone.

Looks like the ajax script controlling the opsec app, is calculating the Date() incorrectly. The Date function which operates on 'data.last_time' (which is epoch time of last connection time) is using the offset parameter unnecessarily. Removing the offset solved the issue.

AJAX file location: $app path/appserver/static/opsec.js';
function: getConnInfo()

EDIT:
d = new Date(data.last_time*1000 - offset);

TO:
d = new Date(data.last_time*1000);

Note: Removal of the browser cache maybe required for the changes to take effect.

amarsaroj
Explorer

Firefox 14.0.1

0 Karma

araitz
Splunk Employee
Splunk Employee

Nice! I filed OPSEC-125 for this issue. What browser were you using?

0 Karma

bhanu22
Engager

thanks it fixed the issue

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...