Overriding timezone in props.conf

[howyagoin]

Hi,

I'm trying to get Splunk to recognise my timezone based on a TZ and TIME_PREFIX setting in props.conf. However, it seems to get overridden by the presence of a timezone in the event line.

My props.conf:

[wireshark-test3]
TZ=Australia/Sydney
TIME_PREFIX = \s+Arrival\sTime:
LINE_BREAKER = ([\r\n]+)([\r\n]+)
BREAK_ONLY_BEFORE = ^Frame

Example data:

Frame 4397: 917 bytes on wire (7336 bits), 917 bytes captured (7336 bits)
    Arrival Time: May  7, 2011 12:38:46.463639654 EST
    Epoch Time: 1304735926.463639654 seconds
    [Time delta from previous captured frame: 0.020186528 seconds]
    [Time delta from previous displayed frame: 0.088711321 seconds]

...

My props.conf correctly breaks down events, however, it sees the "EST" and assumes that is US/Eastern Standard Time, not Australian Eastern Standard Time.

Is this fixable in props.conf, or am I going to have to add something to transforms.conf to get this to work correctly?

At the moment it's reading in the data and assuming the US value, which of course breaks things...

[gkanapathy · Accepted solution]

If you want to ignore the time zone in the event, you should set TIME_FORMAT to something without the time zone, possibly:

TIME_FORMAT = %b %d, %Y %H:%M:%S.%9N

But since you have the epoch time, it might be better to avoid the time zone issue completely and just use:

TIME_PREFIX = Epoch Time:
TIME_FORMAT = %s.%9N
MAX_TIMESTAMP_LOOKAHEAD = 24

Also (nothing to do with your question), your linebreaking/linemerge rules, while correct, would be more efficient as:

SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=Frame)

[howyagoin]

Brilliant, thanks, that did it. And thanks for the more efficient way of doing the linebreaking!