I installed the Splunk Add-On for AWS on my HF and created an input with a custom data type to ingest the AWS instance logs (basically Linux and Windows event logs), with a custom sourcetype of aws:s3:hostOS, but the problem is when I search the logs the timestamps are showing up as +4. I'm EST and the OS logs are GMT.
Do I need to modify the props.conf on my HF to adjust for GMT, or on the SH cluster, or on both the HF and SH cluster?
Thx
It could be the TIME_FORMAT is not correct to the time zone is not detected correctly or maybe the TZ attribute needs to be added.
Please share the props.conf settings for the aws:s3:hostOS sourcetype. Please also share some example events so we can see what the timestamps look like.
Rich,
Thx for the reply.
The input I had to use was the custom data type that does not have a corresponding stanza in props.conf.
I was seeing events as follows with timestamps a few hours ahead:
Oct 22 22:10:01 ip-X-X-X-X systemd: Stopping User Slice of root.
I created a props.conf file in the local dir of the add-on on my HF and added the following stanza:
[aws:s3:hostOS]
TZ = GMT
and now when I run a search the timestamps are as follows:
Oct 22 22:13:06 ip-x-x-x-x dhclient[3010]: XMT: Solicit on eth0, interval 127130ms.
I believe this fixed the issue
Thx