Getting Data In

how does time synchronization work between forwarder and indexer?

New Member

we have hosts sending logs to indexer using universal forwarders. The hosts are spread across different time zones.
i want to know how the indexer Synchronize different time zones into one. Can you refer any document or something?

thank you

0 Karma

Esteemed Legend

The Indexers work by doing whatever you tell them to do. If you tell them nothing about timezones, then each indexer will assume that any event with a date missing a timezone is using the same timezone as that Indexer's host OS and that event will be assigned a value of local for date_zone. This is TERRIBLE rookie admin, though; I do not allow events with date_zone = local to exist on any of my Indexers. Each event should EITHER have the TZ value inside of each event's timestamp OR each host+sourcetype combination should have a TZ=foo/bar in a props.conf on every Indexer. That is the way to do it or you are going to have broken (mis-normalized) times inside of Splunk events (all over the place).

Esteemed Legend

In other words, there is no synchronization, there is a normalization to UTC in the form of time_t AKA epoch.

0 Karma

Ultra Champion

@woodcock strikes again! FTW!

0 Karma