Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- TimeZone issue
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am having issue with some ironport logs with Time zone. The logs are coming in as UTC "2017-05-04T16:05:40+00:00" but it is actually CDT time. How do i tell Splunk in props.conf to ignore +00:00 at the end and look at it as CDT time zone.
I have tried the following but didnt work
[source:::///.....//.log]
TZ = US/Central
Also tried using [host::2.2.2]
Any help would be welcomed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That time zone offset, if present, takes precedence over the TZ value, per this page -
https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Applytimezoneoffsetstotimestamps
In order for the TZ to work, therefore, the +00:00 needs to be ignored completely. So you just need to redo the time format for that source type to NOT have that aspect of the input being considered as part of the time stamp.
props.conf -
[source:::///.....//.log]
TZ = US/Central
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That time zone offset, if present, takes precedence over the TZ value, per this page -
https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Applytimezoneoffsetstotimestamps
In order for the TZ to work, therefore, the +00:00 needs to be ignored completely. So you just need to redo the time format for that source type to NOT have that aspect of the input being considered as part of the time stamp.
props.conf -
[source:::///.....//.log]
TZ = US/Central
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
