hI,
Setting up a syslog feed and run into something that I haven't yet:
2014-03-17T02:02:26-04:00
What does the T stand for? The time is one hour behind the current timestamp, so I'm assuming that it's a timezone?
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?r=splunky
If Splunk is not auto detecting the timezone, you can force the timezone for a sourcetype as shown in the props documentation linked above; look for TZ =
T stands for time. the timezone adjustment is the -4:00 at the end.
Don't want to do it without props - trying to follow the recommended guidelines - configuring time_zone, time_format....
Here's what I have:
[acme_syslog]
MAX_TIMESTAMP_LOOKAHEAD = 30
NO_BINARY_CHECK = 1
TIME_FORMAT = %y-%m-%dT%H:%M:%S
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
LINE_BREAKER = ([\r\n]+)
TZ = US/Central
Splunk can process this format without any props.conf configuration.
Thanks. I looked at the doc, but I'm still unclear. How would you reference the T? Or would you reference the -4:00?
So, how would I configure that in props.conf?