Getting Data In

What makes difference timezone on same sourcetype by two Heavy Forwarder

michael_wong
Path Finder

Dear,

I have an timezone issue on data input by Heavy Forwarder.

We have two Heavy Forwarder, xxx60520  showed date_zone is -420, the time is correct.

xxx64320 is another HF showed date_zone is local, , this one has issue.

Both Heavy Forwarder were inject log by Zscaler App though API

Because both HF using same indexer and SH head, I have no idea  why the same configuration on both Heavy Forwarder have different time_zone.

props.conf of APP

[zscalerapi-zia-audit]
TZ = PST8PDT
TIME_PREFIX = Time\":\s+\"
TIME_FORMAT = %d %b %Y %H:%M:%S, %Z
MAX_TIMESTAMP_LOOKAHEAD = 25

 

sourcetype="zscalerapi-zia-audit" | stats count by host date_zone

Search result

hos                   date_zone     count
xxx60520     -420                   2777

xxx64320      local                 1872

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That the two HFs use the same indexer and SH has no bearing on this problem.  The HFs are parsing the logs independently.

Please share sample events for the zscalerapi-zia-audit sourcetype from each HF.

Are the props.conf settings installed on both HFs?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

That the two HFs use the same indexer and SH has no bearing on this problem.  The HFs are parsing the logs independently.

Please share sample events for the zscalerapi-zia-audit sourcetype from each HF.

Are the props.conf settings installed on both HFs?

---
If this reply helps you, Karma would be appreciated.

michael_wong
Path Finder

I want to make your post as a solution, but seems click the wrong button.

Sorry for that.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I changed it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

michael_wong
Path Finder

Very helpful. The problem was I put the props.conf  in indexer instead of HF. After move the conf to HF, the issue was solved. 

Thank you for your help.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...