If props.conf is used on a universal forwarder, does the parsing automatically happen there?

[jamesvz84]

I downloaded the Windows App TA, which has props.conf settings that go on the UF TA.

I am now noticing that when I change the timezone settings on the heavy forwarder or indexer, the changes are not taking effect.

Is this due to the fact that the props.conf on the UF means the data is getting parsed on the UF?

I've tried many other things to try to get the timezone settings to work. I already verified that the timezone settings were present and splunkd was restarted, first on the HF, then the indexer when HF changes didn't work.

These are my latest props.conf settings in case anyone is curious.

[host::ASM*]
MAX_TIMESTAMP_LOOKAHEAD = 24
TIME_FORMAT=%m/%d/%Y %H:%M:%S.%3N
TIME_PREFIX=^
TZ = Australia/Melbourne
MAX_DAYS_AGO = 5
MAX_DAYS_HENCE = 5
MAX_DIFF_SECS_AGO = 2147483646
MAX_DIFF_SECS_HENCE = 2147483646

This is a sample event. It is being indexed with a timestamp of 8/13/14 11:17:19.000 AM instead of the time in the message:

08/14/2014 02:17:19.947 +1000
collection=CPU
object=Processor
counter="% Processor Time"
instance=_Total
Value=0.23577421459347603

[ChrisG]

See Types of forwarders in the Forwarding Data manual for more information:

The universal forwarder's sole purpose is to forward data. Unlike a full Splunk Enterprise instance, you cannot use the universal forwarder to index or search data. To achieve higher performance and a lighter footprint, it has several limitations:

• The universal forwarder has no searching, indexing, or alerting capability.
• The universal forwarder does not parse data.
• Unlike full Splunk Enterprise, the universal forwarder does not include a bundled version of Python.

You might want to rephrase and post your question again, so that it is focused on time zone settings with the Windows TA.

[MuS]

Hi jamesvz84,

Take a look at this wiki entry http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings and you will see that parsing will never happens on an UF.

Hope this helps ...

Cheers, MuS