Getting Data In

Timestamp not Reflecting Timezone Configuration

rturk
Builder

Hi Splunkers & Splunkettes!

So I have a series of devices that logs in UTC as follows:

2011-10-30 23:24:13 0 2 0 0 N 1440 2473 402 249 0.00 0.00 435314688 0 0 0 0 0 8 

I want ensure Splunk treats this as UTC value when searches are run, so I have ensured that TZ = UTC is in the relevant props.conffiles (Yes I have checked the configuration hierarchy).

Despite this, when searches are run, the time stamp doesn't reflect the local time changes:

Splunk Timestamp                Event Timestamp
10/30/11 11:25:01.000 PM        2011-10-30 23:25:01 ...

This is despite other identically configured timestamps reflecting the desired timezone:

Splunk Timestamp                Event Timestamp
10/31/11 10:29:56.000 AM        [30/Oct/2011:23:21:37.560+0000] ...

This is doing my head in, so any and all assistance appreciated!!

Tags (2)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

The answer might be that your search head is not in UTC timezone. Splunk uses TZ= in props.conf to figure out what offset to apply to _time during indexing. But, at display time, _time is formatted from a time_t to a string in the search head's local timezone.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The answer might be that your search head is not in UTC timezone. Splunk uses TZ= in props.conf to figure out what offset to apply to _time during indexing. But, at display time, _time is formatted from a time_t to a string in the search head's local timezone.

rturk
Builder

This was indeed the case! Thanks for the answer 🙂

0 Karma

e82than
Communicator

what's your props.conf? post a copy. You may have got your config hierarchy correct, but the events to point to the stanza is?

e.g here
http://splunk-base.splunk.com/answers/29218/filtering-windows-event-logs

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...