Getting Data In

How to configure the timezone to prevent events from appearing in Splunk as 8 hours behind the present time?

responsys_cm
Builder

I have a light forwarder listening on tcp:514. It forwards data to three indexers, all of whose clocks are set to UTC time.

Several Cisco WSA proxy appliances are sending logs to the light forwarder. The WSAs don't support UTC time, so they are in US/Pacific and in Ireland.

Their syslog events arrive on tcp:514. A props/transforms identifies those events and changes the sourcetype to cisco:wsa:squid. It then routes that data to the "cisco" index rather than the "syslog" index.

The events are showing up in Splunk as being eight hours behind the present time.

I have tried:

[source::tcp:514]
TZ = US/Pacific

[cisco:wsa:squid]
TZ = US/Pacific

[host::10.10.10.10]
TZ = US/Pacific

And none of these work... I've also tried America/Los_Angeles, PDT, and PST. I feel like I'm taking crazy pills... what am I doing wrong?

0 Karma

mrgibbon
Contributor

Hi, this is a format for props.conf I have used before, it might help.

# Props.conf

[source::udp]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = false
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %b %d %H:%M:%S
TZ = America/Chicago

set the host as from the incoming udp packet

TRANSFORMS-gethostfromdata = set_host

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...