Time Zone Confusion

[tgiles]

Hi, All.

I’m running into an issue with heavy forwarders not setting the time zone correctly when sending logs to my indexer. All indexers are on CST, and forwarders can be pretty much anything.

I’ll step through a device and see if you can pin down where I’m doing it terribly wrong. The available docs aren't the most clear-cut on this topic.

OK, log in to a system with a date problem, check the date:

SWEB1 ~ # date
Mon Jul 23 18:21:03 EDT 2012

edit /opt/splunk/etc/system/local/props.conf on the heavy forwarder and set the time zone:

[host::*]
TZ = US/Eastern

Restart the heavy forwarder, view logs on indexer. They’re still showing up with the incorrect time zone (I.E. one hour off from CST)

What do I need to do to make the EST logs on the heavy forwarder show up as CST on the indexer?

According to the docs, the examples like US/Eastern and US/ Pacific are used as for setting Splunk TZ, then points us to Wikipedia for a much more thorough treatment of what to put in there.

However, the Wikipedia page does not use either US/Eastern and US/ Pacific at all for TZ entries. America/New_York or America/Los_Angeles is listed as correct. Which one will work best for Splunk?

Edit: this is occurring with all new data sent by the forwarder after I adjusted the props.conf on the heavy forwarder. I'm ignoring any historical data for this test.

If you could point me in the right direction, I'd appreciate it.

tom

[lguinn2]

So here's the deal - the timezone setting will only apply to new data arriving in Splunk. Any existing data (that has already been indexed) will not be changed.

So the only way to correct the data would be to remove it from the index and then reindex it. This will be a tedious endeavor, but it may be your best solution.

Here is a pretty good entry that describes the steps in reindexing.

[tgiles]

Hi, Thanks for the input. I probably should have been clearer- all of the new data coming into the indexer is still an hour off, even after performing a timezone adjustment on the forwarder.