Getting Data In

Timestamp not Reflecting Timezone Configuration

rturk
Builder

Hi Splunkers & Splunkettes!

So I have a series of devices that logs in UTC as follows:

2011-10-30 23:24:13 0 2 0 0 N 1440 2473 402 249 0.00 0.00 435314688 0 0 0 0 0 8 

I want ensure Splunk treats this as UTC value when searches are run, so I have ensured that TZ = UTC is in the relevant props.conffiles (Yes I have checked the configuration hierarchy).

Despite this, when searches are run, the time stamp doesn't reflect the local time changes:

Splunk Timestamp                Event Timestamp
10/30/11 11:25:01.000 PM        2011-10-30 23:25:01 ...

This is despite other identically configured timestamps reflecting the desired timezone:

Splunk Timestamp                Event Timestamp
10/31/11 10:29:56.000 AM        [30/Oct/2011:23:21:37.560+0000] ...

This is doing my head in, so any and all assistance appreciated!!

Tags (2)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

The answer might be that your search head is not in UTC timezone. Splunk uses TZ= in props.conf to figure out what offset to apply to _time during indexing. But, at display time, _time is formatted from a time_t to a string in the search head's local timezone.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The answer might be that your search head is not in UTC timezone. Splunk uses TZ= in props.conf to figure out what offset to apply to _time during indexing. But, at display time, _time is formatted from a time_t to a string in the search head's local timezone.

rturk
Builder

This was indeed the case! Thanks for the answer 🙂

0 Karma

e82than
Communicator

what's your props.conf? post a copy. You may have got your config hierarchy correct, but the events to point to the stanza is?

e.g here
http://splunk-base.splunk.com/answers/29218/filtering-windows-event-logs

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...