Splunk Search

Bluecoat Events

Explorer

When I search -> index -> index volume to show event receive status. But when I click on bluecoat events it show me no matching evetns. And also, bluecoat events always shows last 8 hours. Even I add

[bcoat_proxysg] TZ = Asia/Taipei

It's still not work, how could I fix it?

Tags (1)
0 Karma

New Member

Hi ITSD,
Ran into a similar problem where the logs were coming in but the date timestamp of the logs were all off.

I recommend reading the docs on props.conf and then explicitly setting the following things in your props.conf file:

TIME_PREFIX
TIME_FORMAT
TZ

By explicitly setting your TIME_FORMAT it won't guess and you'll be able to help it understand when it occurred.

I hope that helps.

0 Karma

Communicator

try to do this. I just bump into this problem too when i was using the app in your timezone. Bluecoat ProxySG devices sends out data as UTC. but when viewing you would want it to show your own time zone. I screw up a little when i was fixing it by typing UTC+08. Which will bring your data forward by 8 hours. Try my way and see if it will work. It should.

[bcoat_proxysg]
TZ = UTC

0 Karma