Time in palo alto events

[adrifesa95]

Good morning,

I have started to ingest Palo Alto FW events and they are coming with a wrong timestamp, timestamp is 2 hour less than real time.

I am going to show an example:

This is a event in my SCP:

adrifesa95_0-1711447693943.png

My SCP is in Spain time (UTC+1), 11.06 right now. The events are coming wih timestamp of 9.06, although they are ingesting 11.06.

PA server is in Mexico and timestamp in raw event is 4.06, 5 less hour. And heavy forwarder is also in mex but its hour is EDT time:

adrifesa95_1-1711447942962.png

If i have explained me properly, how can i fix it?

[PickleRick · Accepted solution]

1. If you can, don't receive syslog traffic directly on splunk component. Especially if you have lots of traffic. There are better ways to do that. But it has nothing to do with the timezone problem.

2. Since the timestamp in the event does not contain timezone information, the timezone is inferred from other sources. Either defined statically in the props.conf for sourcetype, source or host or taken from the timezone your forwarder is running in. There are several posible ways to tackle this.

a) Best solution - make the source send TZ info along with the timestam. I'm not sure however if your palo can do that

b) Not that bad solution - make your source log in UTC and configure Splunk to interpret your events as UTC

c) Worst solution from the maintenance point of view - set the props for this source in Splunk (on your HF) to the timezone of the source. This can cause issues with daylight saving

[adrifesa95]

last one worked!

[PickleRick]

Bonus question - are your timestamps parsed at all from the events. The event shows just hours/minutes/seconds whereas the _time field in Spkunk shows thousands of a second.