Splunk timezone change for a specific sourcetye

[kteng2024]

Hi,

I am using the timezone converting attribute " _tzhint" to convert EDT to UTC . This attribute was able to convert events timestamp to UTC but it is only converting only very few events, but not all. Below is the how configuration looks. when I use "TZ=UTC" splunk is not converting to UTC timezone , it is still using system time that is the reason I used _tzhint

[monitor:///web/appache.log]
disabled = false
followTail = 0
_tzhint=UTC
index = apache_web
sourcetype=web_logs

[bsriramineni_sp]

"_tzhint"needs to be removed. It is not a documented feature and it was only used in splunk STORM which was the precursor to Cloud. It is NOT supported. So it won't change the logs timestamp.

Analyse your logs and set proper values for the below parameters in props.conf file.

[web_logs]
TIME_PREFIX = link text
MAX_TIMESTAMP_LOOKAHEAD = link text
TIME_FORMAT = link text
TZ = UTC

The above configuration should fix this issue.

For more details, refer the below links:

http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf#Timestamp_extraction_configuration

http://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps

http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Configurepositionaltimestampextraction