Getting Data In

How do I make sure that my events will always be indexed with the right timezone when using an INGEST_EVAL?

andrewtrobec
Motivator

Hello,  I am looking for some clarifications when using an INGEST_EVAL to set a timezone during index time.

The timezone I am working with is Romania which is +0200 or EET standard time and +0300 or EEST daylight savings time.  No Romanian cities are available in the Splunk timezone list so I am using Beirut which according to this page is on the same timezone year round as Romania.

Now for my data I am indexing using an INGEST_EVAL which takes the timestamp from the source where each filename has the following format and reflects local Romanian time:

this_is_my_file_2020_10_27_10_55_53.csv

Since there is no timezone specified in the filename and since the Splunk system time is set to UTC I need to append the timezone using the INGEST_EVAL:

INGEST_EVAL = _time=strptime(replace(source,".*(?=/)/","")."EET","this_is_my_file_%Y_%m_%d_%H_%M_%S.csv%Z")

Now for my concern.  Since I have hardcoded "EET" in the INGEST_EVAL, will this skew the files that are ingested during the daylight savings period?  In other words, if a filename comes in during EEST, so 2020-10-01 for example, will Splunk understand not to use "EET" and use "EEST" instead even though it is not specified in the INGEST_EVAL?

To conclude, I hate timezones 🙂

Any input would be greatly appreciated.

Thank you and best regards,

Andrew

Labels (4)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...