Getting Data In

How does timezone assignment work for timezoneless events with one or more Intermediate Forwarders?

muebel
SplunkTrust
SplunkTrust

One of the new features in Splunk 6.0+ is the capability of a forwarder assigning a timezone to an event in the situation where the timestamp can't be parsed from the raw event, and there isn't any props configuration assigning a timezone. This assignment is described as being based on the OS of the forwarder, and ultimately the Indexer itself. Events like this show up as "date_zone = local"

I hoping that somebody has some experience with this interaction, and can explain what happens when you have one or more Intermediate forwarders (source Universal Forwarder sends to Intermediate "Heavy Forwarder" which sends to an Indexer, or even another Heavy Forwarder).

Assuming the whole chain is 6.0+, should we expect the timezone assigned at the Universal Forwarder and stay that way? Or does the assignment happen when the data is "cooked" at the Heavy Forwarder? Or does it happen whenever the event passes through a pipeline at all?

Thanks for any help!

0 Karma

ryanoconnor
Builder

Have you taken a look at this page? http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Applytimezoneoffsetstotimestamps#How_Splunk_a...

Assuming the whole chain is 6.0+, you should expect the data to use the timezone provided by the UF provided there is no explicit props.conf file specifying the timezone and if the raw event data doesn't contain a timezone.

0 Karma

dflodstrom
Builder

It looks like there is one catch according to this page: link text

Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist solely of light or universal forwarders.

0 Karma

muebel
SplunkTrust
SplunkTrust

So, while reading the Forwarder Manual I came across this passage:

Timezone transmission by the forwarder. Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist of light or universal forwarders.

This seems to have some relevance to the initial question, but still doesn't seem quite clear what the expected behavior should be.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...