Getting Data In

How does timezone assignment work for timezoneless events with one or more Intermediate Forwarders?

muebel
SplunkTrust
SplunkTrust

One of the new features in Splunk 6.0+ is the capability of a forwarder assigning a timezone to an event in the situation where the timestamp can't be parsed from the raw event, and there isn't any props configuration assigning a timezone. This assignment is described as being based on the OS of the forwarder, and ultimately the Indexer itself. Events like this show up as "date_zone = local"

I hoping that somebody has some experience with this interaction, and can explain what happens when you have one or more Intermediate forwarders (source Universal Forwarder sends to Intermediate "Heavy Forwarder" which sends to an Indexer, or even another Heavy Forwarder).

Assuming the whole chain is 6.0+, should we expect the timezone assigned at the Universal Forwarder and stay that way? Or does the assignment happen when the data is "cooked" at the Heavy Forwarder? Or does it happen whenever the event passes through a pipeline at all?

Thanks for any help!

0 Karma

ryanoconnor
Builder

Have you taken a look at this page? http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Applytimezoneoffsetstotimestamps#How_Splunk_a...

Assuming the whole chain is 6.0+, you should expect the data to use the timezone provided by the UF provided there is no explicit props.conf file specifying the timezone and if the raw event data doesn't contain a timezone.

0 Karma

dflodstrom
Builder

It looks like there is one catch according to this page: link text

Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist solely of light or universal forwarders.

0 Karma

muebel
SplunkTrust
SplunkTrust

So, while reading the Forwarder Manual I came across this passage:

Timezone transmission by the forwarder. Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist of light or universal forwarders.

This seems to have some relevance to the initial question, but still doesn't seem quite clear what the expected behavior should be.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...