Getting Data In

How to adjust timestamps for some sources coming from the universal forwarder?

bigfatyeastroll
Path Finder

I have a certain host that sends several logs from multiple sources using the Linux Universal Forwarder. Most of these logs are written in the host and then to Splunk as UTC although the host is configured with the correct local time. How do I get Splunk to display the local time zone instead of UTC?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

All records added to splunk should be added in UTC. Each user can change the display time to their local preference, but the underlying records should always be converted to UTC on ingestion.

Go to your user preference screen and set your time zone preference.

0 Karma

bigfatyeastroll
Path Finder

That's already set accordingly, however, a few log sources from 1 host are still listed under the Search & Reporting as UTC.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Specify the local time zone using TZ = in the forwarder's props.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...