Getting Data In

Exchange CAS IIS timezone conversion issue?

asofo
Path Finder

I'm working with Exchange IIS data from our CAS servers and am having trouble with Splunk translating the time from UTC to EST at indexing time. Looking into this, Splunk is supposed to translate the time zone using the local time of the universal forwarder host. This is the case for all other IIS data in my environment, except for the CAS logs. I've tried to hard set the TZ in my props config, but to no avail. This is causing a 5 hour delay in log visibility.

This is how I'm seeing the time in the CAS IIS event:
alt text

This is how I'm seeing the time in other IIS events and how I want to see the CAS event time:
alt text
Has anyone run into this issue, or have a way to solve it? If Splunk is already able to handle IIS data, what makes CAS IIS data so different that the same rules don't apply? For the record, the version we're running is 6.6.1.

0 Karma

woodcock
Esteemed Legend

You need to upgrade your forwarder. The documentation here:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Applytimezoneoffsetstotimestamps

says this:

If the forwarder and the receiving indexer are version 6.0 or later, use the time zone that the forwarder provides.

Then bounce your forwarder's Splunk instance(s).

The pre-v.6 way is to set a host-based stanza on your indexers to hardcode a value for TZ. Then bounce your indexers' Splunk instance(s).

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...