Getting Data In

Overriding timezone in props.conf



I'm trying to get Splunk to recognise my timezone based on a TZ and TIME_PREFIX setting in props.conf. However, it seems to get overridden by the presence of a timezone in the event line.

My props.conf:

TIME_PREFIX = \s+Arrival\sTime:
LINE_BREAKER = ([\r\n]+)([\r\n]+)

Example data:

Frame 4397: 917 bytes on wire (7336 bits), 917 bytes captured (7336 bits)
    Arrival Time: May  7, 2011 12:38:46.463639654 EST
    Epoch Time: 1304735926.463639654 seconds
    [Time delta from previous captured frame: 0.020186528 seconds]
    [Time delta from previous displayed frame: 0.088711321 seconds]


My props.conf correctly breaks down events, however, it sees the "EST" and assumes that is US/Eastern Standard Time, not Australian Eastern Standard Time.

Is this fixable in props.conf, or am I going to have to add something to transforms.conf to get this to work correctly?

At the moment it's reading in the data and assuming the US value, which of course breaks things...

Tags (2)
0 Karma

Re: Overriding timezone in props.conf

Splunk Employee
Splunk Employee

If you want to ignore the time zone in the event, you should set TIME_FORMAT to something without the time zone, possibly:

TIME_FORMAT = %b %d, %Y %H:%M:%S.%9N

But since you have the epoch time, it might be better to avoid the time zone issue completely and just use:

TIME_PREFIX = Epoch Time:

Also (nothing to do with your question), your linebreaking/linemerge rules, while correct, would be more efficient as:

LINE_BREAKER = ([\r\n]+)(?=Frame)

View solution in original post


Re: Overriding timezone in props.conf


Brilliant, thanks, that did it. And thanks for the more efficient way of doing the linebreaking!

0 Karma