Dear,
I have an timezone issue on data input by Heavy Forwarder.
We have two Heavy Forwarder, xxx60520 showed date_zone is -420, the time is correct.
xxx64320 is another HF showed date_zone is local, , this one has issue.
Both Heavy Forwarder were inject log by Zscaler App though API
Because both HF using same indexer and SH head, I have no idea why the same configuration on both Heavy Forwarder have different time_zone.
props.conf of APP
[zscalerapi-zia-audit]
TZ = PST8PDT
TIME_PREFIX = Time\":\s+\"
TIME_FORMAT = %d %b %Y %H:%M:%S, %Z
MAX_TIMESTAMP_LOOKAHEAD = 25
sourcetype="zscalerapi-zia-audit" | stats count by host date_zone
Search result
hos date_zone count
xxx60520 -420 2777
xxx64320 local 1872
That the two HFs use the same indexer and SH has no bearing on this problem. The HFs are parsing the logs independently.
Please share sample events for the zscalerapi-zia-audit sourcetype from each HF.
Are the props.conf settings installed on both HFs?
That the two HFs use the same indexer and SH has no bearing on this problem. The HFs are parsing the logs independently.
Please share sample events for the zscalerapi-zia-audit sourcetype from each HF.
Are the props.conf settings installed on both HFs?
I want to make your post as a solution, but seems click the wrong button.
Sorry for that.
I changed it.
Very helpful. The problem was I put the props.conf in indexer instead of HF. After move the conf to HF, the issue was solved.
Thank you for your help.