Getting Data In

Why is Indexer ignoring TZ setting?

scottsavareseat
Path Finder

I'm using an HTTP Event Collector to ingest Palo Alto logs from my syslog forwarders. Its using the raw endpoint: 'https://host:8088/services/collector/raw'

I'm using the Splunk_TA_paloalto to do sourcetyping and field extraction. it also does the time extraction which appears to work. However, my devices are in the pacific timezone and not UTC (don't ask why... I just can't fix it). So I create a local directory and a props.conf file in there that looks like:

 

-bash-4.2$ pwd
/opt/splunk/etc/master-apps/Splunk_TA_paloalto/local
-bash-4.2$ cat props.conf
[pan_log]
TZ = US/Pacific

[pan:traffic]
TZ = US/Pacific

 

Then I go to apply the cluster bundle and push the timezone changes to my indexers (this is an indexer cluster).

However, traffic still is received in the UTC timezone.  What am I missing? Why won't the indexers correct the time?

The Palo app takes in logs using the pan_log sourcetype. It then runs transforms to set the correct sourcetype to pan:traffic or whatever type (I'm testing with just traffic logs at this point). In theory, I think it should work with just the pan_log sourcetype as time extraction happens before transforms. But it isn't working. I also tried blocks for [source::http:myinput] but that did nothing as well.

What am I missing?

I'm also trying to change the TIME_FORMAT and override datetime.xml. That doesn't work either. Clearly I'm missing something.

Labels (1)
0 Karma
1 Solution

scottsavareseat
Path Finder

Solved by restarting the indexers.

View solution in original post

Tags (1)
0 Karma

scottsavareseat
Path Finder

Solved by restarting the indexers.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...