Getting Data In

How can i change timestamp?(Moscow Timezone inexactness)

andrey2007
Contributor

Hello,
i have Splunk on freebsd 8.2 and i collect logs from Cisco Ips with Splunk for Cisco IPS App(using scripted input). Trouble is in timestamps, if event occurs at present moment, i see this event on splunk through some seconds, but with timestamp like this event was one hour ago. On freebsd i have Moscow timezone and correct time, time on Ips corresponds to realtime too, but in Splunk (Manager=>Your account) Moscow timezone is UTC+3, but really Moscow timezone is UTC+4. This is a problem. How can i change timestamps? Or may be somebody knows another solution for this problem.
P.s. i tryed to change props.conf for this app, may be i forgot something? this is my props.conf
[source::/opt/splunk/etc/apps/Splunk_CiscoIPS/var/log/ips_sdee.log.192.22.97.82]
[cisco_ips_syslog]
TZ = AE

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

"Moscow timezone is UTC+3, but really Moscow timezone is UTC+4"
the timezone definition comes from your system TZ tables, double check that your system is up to date on the indexers and search-heads. see in /usr/share/zoneinfo/

on linux you can try any timezone conversion of the current time with
date; export TZ=AE; date

0 Karma

andrey2007
Contributor

Yes, my system is up to date and with correct time, for testing i have one Splunk instance.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...