Getting Data In

IIS FTP LOG TIMEZONE PROBLEM

jscnet
Engager

Using IIS FTP Server, Server 2008 RC2. FTP log format is W3C (UTC Timestamps). Splunk pulls the logs (entries) in just fine, however the time is wrong, that is, there's no conversion from UTC to US/Pacific.

I've looked on this forum and Google and tried modifying the /etc/system/local/props.conf file in the following way (btw: splunk is also running on Windows Server 2008 RC2):

[iis_ftp]
TZ = Etc/UTC

[iis]
TZ = Etc/UTC

AND ...

[sourcetype::iis_ftp]
TZ = Etc/UTC

[sourcetype::iis]
TZ = Etc/UTC

Neither works, no conversion to US/Pacific (or my local timezone). I of course restarted splunk after modifying props.conf. I've looked at the following:

http://splunk-base.splunk.com/answers/9666/iis-log-timezone
http://splunk-base.splunk.com/answers/1425/timezones-iis-w3c-extended-logging-why-dont-they-work
http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/ApplyTimezoneOffsetstotimestamps
http://splunk-base.splunk.com/answers/28442/log-time-differs-from-time-on-splunk-host

This to me should be an obvious no-brainer and a VERY common topic. Perhaps I've misread something in those articles -- just doesn't work. Any solutions? Thanks, J.

Tags (3)
0 Karma
1 Solution

ziegfried
Influencer

Have you tried using:

TZ = UTC

View solution in original post

ziegfried
Influencer

Have you tried using:

TZ = UTC

DominikW
Engager

Worked here also! Thank you!

0 Karma

jscnet
Engager

Thanks @Ziegfried. That worked.

0 Karma

yannK
Splunk Employee
Splunk Employee

are not IIS logs ALWAYS in GMT ?

0 Karma

jscnet
Engager

Using Splunk version 4.2.3

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...