Where to convert GMT for cluster?

[jwalzerpitt]

I installed the Splunk Add-On for AWS on my HF and created an input with a custom data type to ingest the AWS instance logs (basically Linux and Windows event logs), with a custom sourcetype of aws:s3:hostOS, but the problem is when I search the logs the timestamps are showing up as +4. I'm EST and the OS logs are GMT.

Do I need to modify the  props.conf on my HF to adjust for GMT, or on the SH cluster, or on both the HF and SH cluster?

Thx

[richgalloway]

It could be the TIME_FORMAT is not correct to the time zone is not detected correctly or maybe the TZ attribute needs to be added.

Please share the props.conf settings for the aws:s3:hostOS sourcetype.  Please also share some example events so we can see what the timestamps look like.

[jwalzerpitt]

Rich,

Thx for the reply.

The input I had to use was the custom data type that does not have a corresponding stanza in props.conf.

I was seeing events as follows with timestamps a few hours ahead:

Oct 22 22:10:01 ip-X-X-X-X systemd: Stopping User Slice of root.

 I created a props.conf file in the local dir of the add-on on my HF and added the following stanza:

[aws:s3:hostOS]
TZ = GMT

and now when I run a search the timestamps are as follows:

Oct 22 22:13:06 ip-x-x-x-x dhclient[3010]: XMT: Solicit on eth0, interval 127130ms.

I believe this fixed the issue

Thx