how to change splunktimezone if using a trial version of Splunk

[Jeewan]

Hi Team, 

I am using a free trail version of Splunk. and forwarding logs from a Paloalto firewall to splunk. sometimes i am getting logs sometimes not . its seems to be a timeZone issue. my paloalto firewall is in US/Pacific time Zone.  how can I check the Splunk timezone. and how can i configure it same on both the side. 

#splunktimeZone

[richgalloway]

Splunk Cloud operates in the UTC time zones.  Data could come in from any of 23+ other time zones so trying to get them to match is futile.

The correct process is to tell Splunk what time zone the data is from and let it adjust it to the system time.  Do that using props.conf.  The best method to use depends on the data itself.  See the Admin Manual's description of the TZ setting for more information.

The algorithm for determining the time zone for a particular event is as
  follows:
  * If the event has a timezone in its raw text (for example, UTC, -08:00),
  use that.
  * If TZ is set to a valid timezone string, use that.
  * If the event was forwarded, and the forwarder-indexer connection uses
  the version 6.0 and higher forwarding protocol, use the timezone provided
  by the forwarder.
  * Otherwise, use the timezone of the system that is running splunkd.

[Jeewan]

I am using Splunk Enterprise trial version. and i am able to see live events coming from Paloalto to Splunk. but when I am selecting last 30 min logs in splunk its not showing anything when I am selecting all time then its showing the latest events as well.  I am assuming this can be due to timezone issue. I tried to change the Palotalto time Zone but that also didn't work. 

as per you solution using props.conf. can you please help me what need to be change there. my paloalto time Zone is US/Pecific/.  I am completely new to splunk. @richgalloway 

[richgalloway]

Splunk has a multi-day class on how to get data into Splunk so I won't be able to cover the whole subject here.

Every sourcetype ingested into Splunk should have a props.conf stanza that specifies at the "Great Eight" settings.  They are:

SHOULD_LINEMERGE
LINE_BREAKER
TIME_PREFIX
TIME_FORMAT
MAX_TIMESTAMP_LOOKAHEAD
TRUNCATE
EVENT_BREAKER_ENABLE
EVENT_BREAKER

You can read about each of these in the Admin Manual.

Often, the time zone associated with an event is included in the timestamp (for example, "8/30/2024 10:52:00Z" or "8/30/2024 10:52:00-0700").  When that's the case, adding "%Z" or "%z" to the TIME_FORMAT setting is all you need.  If the timestamp does not include zone information then adding the TZ setting to props.conf will help.

TZ = America/Los_Angeles