Getting Data In

Timezones - what am i missing?

Sqig
Path Finder

Hi.

We have some log data where each line starts with a timestamp that looks like this:

2012-09-28 15:44:35,302

Nothing else in the data looks anything like a timestamp.

Splunk is indexing this as UTC, so it displays 4 hours earlier.

The timezone on the source server is in Eastern.

We are running a Splunk Universal Forwarder there, so on the Heavy Forwarder, I have the following:

[my_sourcetype_here]
TZ = US/Eastern

For what it's worth, I also tried with [host::hostnamepattern*]

Neither seem to have taken effect with newly-indexed events, despite actually restarting the Heavy forwarders!

Am I missing something here?

Thanks.

Tags (1)
0 Karma
1 Solution

Sqig
Path Finder

If I could remove a question I have posted, I would in this case. This was user error on my part and not anything to do with Splunk.

View solution in original post

0 Karma

Sqig
Path Finder

If I could remove a question I have posted, I would in this case. This was user error on my part and not anything to do with Splunk.

0 Karma

sowings
Splunk Employee
Splunk Employee

If Splunk is indexing in UTC, then your server is likely set to use UTC. See this link for help on how Splunk sets time zones:

http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/ApplyTimezoneOffsetsToTimeStamps

0 Karma

jcaffero
Explorer

I was having a similar issue, running in Central time. I created a props.conf file within the C:\Program Files\Splunk\etc\system\local filepath with just the value TZ = UTC-6, Eastern would likely be UTC-5 and my timestamps are displaying correctly. Unfortunately I don't see my props.conf file in that directory anymore but the timestamps are still working correctly.

JC

0 Karma

kristian_kolb
Ultra Champion

A bit unclear about the setup - is it UF -> HF -> Indexer?

TZ settings should go to where the parsing phase takes place - in the above scenario, that would be the HF (As can be seen here).

Have you tried either EST or -04:00 instead of US/Eastern?

/Kristian

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...