What makes difference timezone on same sourcetype by two Heavy Forwarder

[michael_wong]

Dear,

I have an timezone issue on data input by Heavy Forwarder.

We have two Heavy Forwarder, xxx60520  showed date_zone is -420, the time is correct.

xxx64320 is another HF showed date_zone is local, , this one has issue.

Both Heavy Forwarder were inject log by Zscaler App though API

Because both HF using same indexer and SH head, I have no idea  why the same configuration on both Heavy Forwarder have different time_zone.

props.conf of APP

[zscalerapi-zia-audit]
TZ = PST8PDT
TIME_PREFIX = Time\":\s+\"
TIME_FORMAT = %d %b %Y %H:%M:%S, %Z
MAX_TIMESTAMP_LOOKAHEAD = 25

sourcetype="zscalerapi-zia-audit" | stats count by host date_zone

Search result

hos                   date_zone     count
xxx60520     -420                   2777

xxx64320      local                 1872

[richgalloway · Accepted solution]

That the two HFs use the same indexer and SH has no bearing on this problem.  The HFs are parsing the logs independently.

Please share sample events for the zscalerapi-zia-audit sourcetype from each HF.

Are the props.conf settings installed on both HFs?

[michael_wong]

I want to make your post as a solution, but seems click the wrong button.

Sorry for that.

[richgalloway]

I changed it.

[michael_wong]

Very helpful. The problem was I put the props.conf  in indexer instead of HF. After move the conf to HF, the issue was solved. 

Thank you for your help.