Getting Data In

how to solve Time difference issue?

Explorer

Hi Guys,
I'm getting the time difference of events in splunk SH.
I've also tried to put TZ = UTC in props.conf of an APP at HFalt text. But didn't work

[sourcetype]



TZ = UTC

0 Karma
1 Solution

Builder
TZ = <timezone identifier>
* The algorithm for determining the time zone for a particular event is as
  follows:
  * If the event has a timezone in its raw text (for example, UTC, -08:00),
  use that.
  * If TZ is set to a valid timezone string, use that.

Based on that, it will only use the TZ setting, if the TZ is not found in the event.

You event has a valid TZ of +1000, which Splunk is applying causing the time to 06:19:27 + 1000 = 16:19:27

If you want it to ignore the timezone set in the timestamp, I believe you will need to configure a custom timestamp extraction for this sourcetype in props.conf:

TIME_FORMAT = <strptime-style format>
* Specifies a "strptime" format string to extract the date.

Although the real fix, is to correct the time on the end device.

You could also have the device sent to a syslog server, that syslog server could apply the timestamp you want as it writes to file, and Splunk can monitor the syslog files.

As long as the latency between your endpoints and syslog servers are low, the timestamps should be close enough and all normalized your specified timezone.

View solution in original post

Builder
TZ = <timezone identifier>
* The algorithm for determining the time zone for a particular event is as
  follows:
  * If the event has a timezone in its raw text (for example, UTC, -08:00),
  use that.
  * If TZ is set to a valid timezone string, use that.

Based on that, it will only use the TZ setting, if the TZ is not found in the event.

You event has a valid TZ of +1000, which Splunk is applying causing the time to 06:19:27 + 1000 = 16:19:27

If you want it to ignore the timezone set in the timestamp, I believe you will need to configure a custom timestamp extraction for this sourcetype in props.conf:

TIME_FORMAT = <strptime-style format>
* Specifies a "strptime" format string to extract the date.

Although the real fix, is to correct the time on the end device.

You could also have the device sent to a syslog server, that syslog server could apply the timestamp you want as it writes to file, and Splunk can monitor the syslog files.

As long as the latency between your endpoints and syslog servers are low, the timestamps should be close enough and all normalized your specified timezone.

View solution in original post

SplunkTrust
SplunkTrust

What is the time zone of the data source? What is the time zone setting for the user who produced the output? What is the TIME_FORMAT setting for the sourcetype?

---
If this reply helps you, an upvote would be appreciated.
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!