multiple timezone in syslog events

[EricPartington]

I am trying to extract the correct timezone and time from the syslog event below.

 Jun 28 17:32:44 10.xxx.xx.240 Jun 28 21:32:44 SRXXXXXC2 auditd: date="Jun 28 21:32:44 2011 UTC",fac=f_http

The timestamp that I want to extract is the one that starts with date="
The first date is EST from the splunk server, the next two are from the firewall (both in UTC)
Some firewalls have the second timestamp in EST, but the third date is always UTC

I have this in my props.conf file

[maaaa_firewall]
TIME_PREFIX = date="
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_FORMAT=%b %d %H:%M:%S %Y %Z

How can I be certain that I am indexing the correct field for the event?

Is there any indication in the indexed event that the timestamp is UTC?

I want to make sure that I am indexing the UTC event and not the first two timestamps (as there could be delay in sending the message to splunk from the device and i would want the time the event occured and not the time the message was recieved)

[jbsplunk · Accepted solution]

If you use TIME_PREFIX with MAX_TIMESTAMP_LOOKAHEAD, Splunk wouldn't even look at the first timestamp. However, I count only 25 characters in your timestamp, so I would set MAX_TIMESTAMP_LOOKAHEAD to 25 instead of 50. Your time format looks correct, so once you fix up the lookahead you'll be all set. By the way, you can be sure that Splunk is using UTC because your log explicitly states UTC in the timestamp you've specified for Splunk to look at. Even if you specified another timezone somehwere else for this sourcetype, splunk trusts the logs over your instructions.