I got a sample log with timestamp format like this:
Thu Dec 20 20:45:24 CST 2012
The CST here means China Standard Time (+8). But Splunk recognize this time zone as US Central Time(-6), so the event timestamp I got is Dec 21 10:45:24 am (with my local system also in +8 timezone). No matter how I set the Timeformat in props.conf to skip the CST timezone, the timestamp won't change. Any idea how I can fix this timezone issue?
In props.conf you can specify the time format that you want applied to your event timestamps.
Can you post the strptime pattern you are specifying..maybe it has an error ?
I actually also tried to resort the "timezone" with the "year" as described here, but the result won't change.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition#Reconfigure_ho...
My current workaround is to modify the datetime.xml to remove the CST from the zone list.
In props.conf you can specify the time format that you want applied to your event timestamps.
Can you post the strptime pattern you are specifying..maybe it has an error ?
This is the correct one. Thanks, Damien!
TIME_FORMAT = %b %d %H:%M:%S CST %Y
I used this:
TIME_FORMAT = %b %d %H:%M:%S \w+ %Y