Adjust timezone for epoch style timestamp

[morgancrocker]

I have some log data that uses timestamps in an epoch-like format, but the issue is that they are logged as if it were in a local timezone rather than UTC. For example, 1394203884 = 14:51:24 March 6 2014 PST.

For example:

ts="1394187680", ...
ts="1394187682", ...
ts="1394187682", ...
ts="1394187682", ...

I understand that this an epoch-like forma and should always refer to UTC, but in this case it does not. Is there any way to configure Splunk to use these fields as timestamps, but not assume that they are UTC?

Update:

I should have mentioned this in the original post, I will update it. I have tried this(props.conf) and use it with other inputs, but Splunk does not seem to apply any TZ settings in this case. I believe this is because it identifies the timestamp as epoch time and assumes it is in UTC.

[lukejadamec]

No. There are a number of posts on the topic, and to summarize them: Epoch time is UTC, and since Splunk will use the raw event timezone if one exists then Splunk will always regard epoch times as UTC.

Some things you can try:

Use another timestamp in the event if one exists.

Correct the app that is generating the bad timestamp.

Preprocess the events to correct the timestamp before sending them to the indexer.

[yannK]

By definition Epoch time is UTC.

http://www.unixtimestamp.com/index.php

The unix time stamp is a way to track time as a running total of seconds. This count starts at the Unix Epoch on January 1st, 1970 at UTC.

So the only solution is to rewrite your timestamp before splunk reads it.