Getting Data In

Exchange CAS IIS timezone conversion issue?

asofo
Path Finder

I'm working with Exchange IIS data from our CAS servers and am having trouble with Splunk translating the time from UTC to EST at indexing time. Looking into this, Splunk is supposed to translate the time zone using the local time of the universal forwarder host. This is the case for all other IIS data in my environment, except for the CAS logs. I've tried to hard set the TZ in my props config, but to no avail. This is causing a 5 hour delay in log visibility.

This is how I'm seeing the time in the CAS IIS event:
alt text

This is how I'm seeing the time in other IIS events and how I want to see the CAS event time:
alt text
Has anyone run into this issue, or have a way to solve it? If Splunk is already able to handle IIS data, what makes CAS IIS data so different that the same rules don't apply? For the record, the version we're running is 6.6.1.

0 Karma

woodcock
Esteemed Legend

You need to upgrade your forwarder. The documentation here:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Applytimezoneoffsetstotimestamps

says this:

If the forwarder and the receiving indexer are version 6.0 or later, use the time zone that the forwarder provides.

Then bounce your forwarder's Splunk instance(s).

The pre-v.6 way is to set a host-based stanza on your indexers to hardcode a value for TZ. Then bounce your indexers' Splunk instance(s).

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!