Getting Data In

Time zone config not working as expected

DavidCaputo
Path Finder

Hello,
I'm trying to configure an ingestion of logs that are in UTC time.
We are in Geneva and timezone is Europe/Zurich (=UTC+2), so, logs are displayed with the wrong date.

For example, log ingested at 14:52 today is displayed in Splunk like this :

 

 

2023-07-05 12:52:40 ..

 

 

These logs are coming from a simple UF (Windows, UF version is 8.2.4). My Splunk environment is Linux (RedHat 8 / Splunk version is 9.0.4)

As documented, I tried to add in a props.conf something like this :

 

 

[source::D:\path\to\file.log]
TZ = Europe/Zurich

 

 

First I added it in the UF configuration. No effect.
Then I tried to put it on indexers. No effect.

I also tried to use the sourcetype name ([my_sourcetype] ) instead of the source path or replace the Europe\Zurich value with "TZ = UTC+2"... it didn't work any better.

Help would be appreciated !
Thanks
David

Labels (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...