hI,
Setting up a syslog feed and run into something that I haven't yet:
2014-03-17T02:02:26-04:00
What does the T stand for? The time is one hour behind the current timestamp, so I'm assuming that it's a timezone?
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?r=splunky If Splunk is not auto detecting the timezone, you can force the timezone for a sourcetype as shown in the props documentation linked above; look for TZ =
T stands for time. the timezone adjustment is the -4:00 at the end.
Don't want to do it without props - trying to follow the recommended guidelines - configuring time_zone, time_format....
Here's what I have:
[acme_syslog] MAX_TIMESTAMP_LOOKAHEAD = 30 NO_BINARY_CHECK = 1 TIME_FORMAT = %y-%m-%dT%H:%M:%S SHOULD_LINEMERGE = false TIME_PREFIX = ^ LINE_BREAKER = ([\r\n]+) TZ = US/Central
Splunk can process this format without any props.conf configuration.
Thanks. I looked at the doc, but I'm still unclear. How would you reference the T? Or would you reference the -4:00?
So, how would I configure that in props.conf?
