Getting Data In

Monitor File shows GMT not local time

hartfoml
Motivator

I am collecting syslog using syslog-ng. the events collected in the file are showing GMT.

When I setup a file monitor for the events they are indexed in the future.

What is the best way to handle this using the sourcetype=syslog?

Tags (3)
0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

in your syslog sourcetype stanza in the props.conf, add:

TZ = UTC

If you don't have one in your local/props.conf, they just add:

[syslog]
TZ = UTC

Then restart the indexer.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

in your syslog sourcetype stanza in the props.conf, add:

TZ = UTC

If you don't have one in your local/props.conf, they just add:

[syslog]
TZ = UTC

Then restart the indexer.

--
Jesse Trucks
Minister of Magic

jtrucks
Splunk Employee
Splunk Employee

Yes. If you need it only for a certain source, use your syslog config to break that out to a separate file or directory tree. Then set up a new source to set the TZ on that source only.

--
Jesse Trucks
Minister of Magic
0 Karma

hartfoml
Motivator

thanks I am in a distributed environment and I cant (am not allowed to) restart the indexers during working hours.

Also wont this change the timestamp for all syslog not just my new one?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...