Security

_time is 6hrs behind but the event time is real time.

sathiyasun
Explorer

I have this props.conf TIME is almost 6hrs off from the event time. Below is my props.

[app_log]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)\d+\-\d+\-\d+\s\d+\:\d+\:\d+\w
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
disabled=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX=^
TZ=US/Central

 

Sample log:-

 

This is event time which is ingesting fine "2023-11-14 10:59:58Z"

2023-11-14 10:59:58Z stevelog Closed Successfully
2023-11-14 10:59:58Z stevelog_close
2023-11-14 10:59:58Z Resetting CWD back from C:\WINDOWS\SysWOW64\inetsrv
2023-11-14 10:59:58Z Resetting CWD complete, back too C:\WINDOWS\SysWOW64\inetsrv
2023-11-14 10:59:58Z steveEngineMain Thread ====================> END

 

The actual TIME is 6hrs how than event time. Please find the attached screen and request you to let me know what the time difference.

sathiyasun_0-1699983123773.jpeg

 




 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It looks correct.  The events are timestamped in UTC, but the props.conf says to convert times to Americas/Chicago, which is 6 hours behind UTC.

I recommend changing the props to extract the time zone from the timestamp.

[app_log]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)\d+\-\d+\-\d+\s\d+\:\d+\:\d+\w
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
disabled=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S%Z
TIME_PREFIX=^
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It looks correct.  The events are timestamped in UTC, but the props.conf says to convert times to Americas/Chicago, which is 6 hours behind UTC.

I recommend changing the props to extract the time zone from the timestamp.

[app_log]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)\d+\-\d+\-\d+\s\d+\:\d+\:\d+\w
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
disabled=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S%Z
TIME_PREFIX=^
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...