Hi,
My timezone is GMT+8, and this caused logs captured in Splunk to always be 8 hours ago.
For instance:
Time log is captured: 2018-10-31 16:17:30,241
Time shown on splunk: 2018-10-31 08:17:30,241
I have tried configuring TZ in props.conf but it does not seem to work. here is snippet of my props.conf
[source]
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
TZ = Asia/Singapore
Thanks for your help!
Hi @zongwei,
Please try below configuration.
props.conf
[source::source-name]
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
TZ = Timezone of event source system where the event is generated (If time in log event is in UTC/GMT then do not specify this option)
Set your timezone into Splunk by going User Setting (above Logout option) -> Timezone
Hello @zongwei. It appears that the props you have for you time format
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
Doesn't match the time in the logs
2018-11-01T03:04:33.916+08:00
Hi @burwell,
I am using TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N because the date of the log that I want the event to be split is 2018-11-01 04:59:40,965
Oh I misunderstood the issue. Also I can't see the example (I see a broken image)
So it sounds to me like perhaps your user profile has a time setting so you are showing the events in a different timezone:
http://docs.splunk.com/Documentation/Splunk/7.2.0/Security/ConfigureuserswithSplunkWeb
When I look at this:
http://docs.splunk.com/Documentation/Splunk/7.2.0/Data/Applytimezoneoffsetstotimestamps
You are providing the time info and the timezone data.
Additonal info:
For every event log, there is the _time field. Example of a _time field:
2018-11-01T03:04:33.916+08:00
It seems that Splunk does know that the time is short by 8 hours, but the logs display ignored the +08:00 behind the _time field.
Is there anyway to workaround with this to display the correct time? Thank you!