Getting Data In

rfc5424_syslog app + rfc5424 event = cannot parse the timezone from event

Engager

Hello!

I have installed rfc5424-syslog_11.tgz on top of Splunk 7.2.6 enterprise.
I want to receive events from DIFFERENT timezones which comply with rfc 5424, like this:

<13>1 2019-04-26T01:57:19.000+08:00 Myhost.mydomain.com MyProduct - 4726 [MyProduct.Predefined@9999 RecordKey="97013316"... and after that follows the rest of the multiline event.

alt text

Everything works fine except the time zone. For the event above Splunk's showing the Time as 4/26/19 1:57:19.000 AM instead of 4/26/19 9:57:19.000 AM, as if I'm receiving events "from the past".
I tried to workaround using Splunk forum, like this:

C:\Program Files\Splunk\etc\apps\rfc5424\local\props.conf:

[rfc5424_syslog]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)(?=<13>\d+\s+)
TIME_PREFIX = ^<13>\d+\s+
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 30

But it does not help to treat the time as 4/26/19 9:57:19.000 AM.
What do I miss?
Thank you!

0 Karma
1 Solution

Motivator

Hello @garrylean,
This event has the timestamp 2AM (UTC+08:00).
When Splunk parses the timestamp, it will save all events in epoch time.
Now when you run a Splunk search, the _time field will display the events in your local time. In your case, that is UTC+-00:00, thus 10 AM.
Your user's time zone can be set when you click on your username at the top and then on "Preferences".

EDIT: See my comment below for the actual solution.

View solution in original post

0 Karma

Ultra Champion

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z does not match 2019-04-26T01:57:19.000+08:00. There is no : before the timezone indicator. Try TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

0 Karma

Motivator

Hello @garrylean,
This event has the timestamp 2AM (UTC+08:00).
When Splunk parses the timestamp, it will save all events in epoch time.
Now when you run a Splunk search, the _time field will display the events in your local time. In your case, that is UTC+-00:00, thus 10 AM.
Your user's time zone can be set when you click on your username at the top and then on "Preferences".

EDIT: See my comment below for the actual solution.

View solution in original post

0 Karma

Engager

Pardon?
My time zone setting is "Default System Timezone", which is actually +8.
I have the simplest scenario, this event happened around 10 AM in my TZ, and was sent by the Sender from the same TZ, and Splunk host is also in the same TZ, but in the Time column I see "4/26/19 1:57:19.000 AM"

0 Karma

Motivator

Then I believe your server (which generates the logs) has misconfigured time settings.
If the server's time zone is +8 and this event is generated at 10 AM in your local time, then the event should read "<13>1 2019-04-26T09:57:19.000+08:00"
If you are running Linux, check your server via the command "timedatectl".

Engager

Oh my, Splunk works fine, the original date was not correct indeed!
You helped to figure it out, thank you!
If we can convert your comment above to a correct answer?

0 Karma

Motivator

@garrylean Glad to hear I could help.
I edited my original answer to point to my comment.

0 Karma