Getting Data In

timezone and Checkpoint logs

nov1ce
Explorer

Hello,

I'm using latest Splunk to collect event logs from a number of W2K8 servers as well as Checkpoint. Everything is working just fine except that if I search logs from Checkpoint in Splunk they appear to be two hours ahead (the time is correct, just two hours ahead). I double-checked system clock on the CP Management gateway and Splunk server - it's correct and synced. No issues with logs coming from Windows servers.

Seems like a timezone settings somewhere in Splunk but I can't find it.

PS: Setting timezone for a user didn't help.

Any hints would be greatly appreciated!

Thanks.

Tags (2)
0 Karma
1 Solution

tgow
Splunk Employee
Splunk Employee

The timezone (TZ) can be set in the props.conf file based on either host, source or sourcetype. Here is a quick example:

[host::nyc*]
TZ = US/Eastern

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/latest/Data/ApplyTimezoneOffsetsToTimeStamps

View solution in original post

tgow
Splunk Employee
Splunk Employee

The timezone (TZ) can be set in the props.conf file based on either host, source or sourcetype. Here is a quick example:

[host::nyc*]
TZ = US/Eastern

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/latest/Data/ApplyTimezoneOffsetsToTimeStamps

nov1ce
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...