rfc5424_syslog app + rfc5424 event = cannot parse the timezone from event

[garrylean]

Hello!

I have installed rfc5424-syslog_11.tgz on top of Splunk 7.2.6 enterprise.
I want to receive events from DIFFERENT timezones which comply with rfc 5424, like this:

<13>1 2019-04-26T01:57:19.000+08:00 Myhost.mydomain.com MyProduct - 4726 [MyProduct.Predefined@9999 RecordKey="97013316"... and after that follows the rest of the multiline event.

Everything works fine except the time zone. For the event above Splunk's showing the Time as 4/26/19 1:57:19.000 AM instead of 4/26/19 9:57:19.000 AM, as if I'm receiving events "from the past".
I tried to workaround using Splunk forum, like this:

C:\Program Files\Splunk\etc\apps\rfc5424\local\props.conf:

[rfc5424_syslog]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)(?=<13>\d+\s+)
TIME_PREFIX = ^<13>\d+\s+
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 30

But it does not help to treat the time as 4/26/19 9:57:19.000 AM.
What do I miss?
Thank you!

[FrankVl]

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z does not match 2019-04-26T01:57:19.000+08:00. There is no : before the timezone indicator. Try TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

[whrg · Accepted solution]

Hello @garrylean,
This event has the timestamp 2AM (UTC+08:00).
When Splunk parses the timestamp, it will save all events in epoch time.
Now when you run a Splunk search, the _time field will display the events in your local time. In your case, that is UTC+-00:00, thus 10 AM.
Your user's time zone can be set when you click on your username at the top and then on "Preferences".

EDIT: See my comment below for the actual solution.

[garrylean]

Pardon?
My time zone setting is "Default System Timezone", which is actually +8.
I have the simplest scenario, this event happened around 10 AM in my TZ, and was sent by the Sender from the same TZ, and Splunk host is also in the same TZ, but in the Time column I see "4/26/19 1:57:19.000 AM"

[whrg]

Then I believe your server (which generates the logs) has misconfigured time settings.
If the server's time zone is +8 and this event is generated at 10 AM in your local time, then the event should read "<13>1 2019-04-26T09:57:19.000+08:00"
If you are running Linux, check your server via the command "timedatectl".

[garrylean]

Oh my, Splunk works fine, the original date was not correct indeed!
You helped to figure it out, thank you!
If we can convert your comment above to a correct answer?

[whrg]

@garrylean Glad to hear I could help.
I edited my original answer to point to my comment.