Getting Data In

timezone issue

ofeefee
New Member

how come if I set the timezone to CST, logs sent with UTC timestamp doesn't get put in CST, they appear to stay as UTC, but then logs without a timestamp get tagged CST. So then I have some logs in CST, some in UTC, so when trying to correlate these, it's a mess! I figured if it was all CST, it would keep them all as Central time, and convert the times.

Tags (1)
0 Karma

ofeefee
New Member

i think this is one of those restrictions that splunkstorm has. if you have data coming in from different timezones you have to put them in seperate projects. Problem is hafl the data is tagged with the timezone data, the other has no timezone data, so it's getting split. I solved it by setting Splunkstorm to UTC, and it's all syncing up now. I just have to do the time shift mentally, not too difficult after this many years.

0 Karma

aholzer
Motivator

I am assuming you mean setting the timezone in the props.conf, as so:

[YourSourcetype]
...
TZ=YourTimezone

If this is the case, then the timezone you want to specify here is the timezone of the events being written to those logs that are being tagged with "YourSourcetype". Example: logInEST.log is being generated on an EST server, monitored by a forwarder and tagged as ESTST (EST SourceType). The props.conf on the indexer, which is a London based server, should be something like this:

[ESTST]
...
TZ=US/Eastern

So when you run a search that captures ESTST, it will convert everything from the US/Eastern to the local time of the indexer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...