Getting Data In

Setting timezone is not working

strive
Influencer

Hi,

We are using Splunk 6.0.3

The host (no matter where it is located) always sends logs with UTC time. In my props.conf file i have added TZ = UTC in the stanza that processes the logs. But still i see the _time as forwarder's time zone.alt text

My Props.conf looks like this:

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)\d{2}-[a-zA-Z]{3}-\d{4}\s\d{2}:\d{2}:\d{2}\s

MAX_TIMESTAMP_LOOKAHEAD=20

TIME_PREFIX=^

TIME_FORMAT=%d-%b-%Y %H:%M:%S

TZ=UTC

Thanks

Strive

Tags (1)
1 Solution

lukejadamec
Super Champion

Splunk will set event time zones according to the following priority:

1) It will use the time zone in the raw event data.

2) It will use the time zone in props.conf

3) If both the forwarder and indexer are 6.0 or later, then it used the time zone of the forwarder.

In your case, the time zone of the event is UTC because the time zone is included in the event.

However, because your MAX_TIMESTAMP_LOOKAHEAD is set to 20, Splunk never sees the time zone so it can't apply it.

I’m not sure why it does not check props.conf before it moves on to the third priority. Perhaps the props.conf is in the wrong location?

Regardless, change your MAX_TIMESTAMP_LOOKAHEAD to 30.

View solution in original post

0 Karma

lukejadamec
Super Champion

Splunk will set event time zones according to the following priority:

1) It will use the time zone in the raw event data.

2) It will use the time zone in props.conf

3) If both the forwarder and indexer are 6.0 or later, then it used the time zone of the forwarder.

In your case, the time zone of the event is UTC because the time zone is included in the event.

However, because your MAX_TIMESTAMP_LOOKAHEAD is set to 20, Splunk never sees the time zone so it can't apply it.

I’m not sure why it does not check props.conf before it moves on to the third priority. Perhaps the props.conf is in the wrong location?

Regardless, change your MAX_TIMESTAMP_LOOKAHEAD to 30.

0 Karma

strive
Influencer

The issue was with forwarder. It is resolved.

jdhruti
New Member

what's was the issue? we are having the same issue where the timezone is set as UTC, but it still indexes data in EDT.

0 Karma

strive
Influencer

Thanks for your response. props.conf is inside /IndexAPP/local/ directory. This splunk app is added to peer nodes (indexers).

Note: we use clusters

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...