How can I set local time zone in many fields in my log ?

[mah]

Hi,

I have json logs which contains  2 time fields :  Horodate and Timestamp

{"ObjectLevelN3": "T", "ObjectIdN2": "R", "ObjectLevelN2": "TAG", "Level": "C3", "Version": "1", "ObjectIdN3": "00:00:03", "Statut": "OK", "Horodate": "2020-12-01T08:14:25.026Z", "ObjectType": "B", "Category": "CU", "Protocol": "PULL", "ObjectLevelN1": "F", "Environment": "DEV", "ObjectIdN1": "WI", "Id": "03d6a3ef", "IdCorrelation": "17103d7f", "Timestamp": "2020-12-01T08:14:00.442Z"}

My props.conf sets the field _time to be like Horodate field :

[test_json]
SHOULD_LINEMERGE = 0
pulldown_type = 1
INDEXED_EXTRACTIONS = json
TIME_PREFIX = Horodate

We are in GMT+1 : so as you can see on the file attached the field _time is like :

12/1/20 9:14:25.026 AM

My issue is : how can I set the fields Horodate and Timestamp in GMT+ 1 ?

[richgalloway]

Since the time zone is included in the timestamp, Splunk should account for it automatically and store the Horodate field in UTC.  It will present the field using the user's preferred time zone.

It may help to put the timestamp format in the props.conf file (always a good idea, anyway).

[test_json]
SHOULD_LINEMERGE = 0
pulldown_type = 1
INDEXED_EXTRACTIONS = json
TIME_PREFIX = Horodate":"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z

[mah]

And  if I set the parameter TZ = Europe/Brussels in the props.conf will not change the time in fields Horodate and Timestamp ? 

[mah]

Ok. My client wanted the time of his logs to be similar to the time of the _time field. For my part, I was wondering about the relevance and the feasibility of this request. You answered me correctly.

Thanks for your answers ! 

[richgalloway · Accepted solution]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[richgalloway]

The time zone in the timestamp overrides the TZ setting.

[mah]

Ok thanks.

Is there a way to add +1hour on fields Horodate and Timestamp by a command line ? 

[richgalloway]

Why do you need to add an hour?  Splunk does time zone conversion automatically based on your user preferences.  Set your time zone to GMT+1 and that is what you should see.