- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Timezone conversion issue Raw Text Data (UTC) to S...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Timezone conversion issue Raw Text Data (UTC) to Splunk Index (EST)
I am sure this question is asked numerous times and there are number of answers around this but for some reason its not working for us.
So, we have an IIS log (w3c) which logs data in Text file in UTC format like "2018-05-02 18:30:00 xx.xx.xx.xx POST /abc/xyz"
The Problem, this log is in UTC and all our users and servers are in EST. While searching or building dashboard, it gets tough to work on two timezone. All other data on servers are in EST.
What we want, along with all data in EST the IIS log should come in Splunk index as EST.
What we tried, we tried query level conversion but thats not efficient enough. Tried Props.conf as suggested in various answers with below formats one by one and none actually helped. Please confirm if we are doing it right..
TZ=UTC
TZ=America/Santiago
TZ=GMT+04:00
TZ=US/Eastern etc
Raw Data: 2018-05-02 18:30:00 xx.xx.xx.xx POST /abc/xyz
Expected Data in Splunk:
_time:14:30:00; Data:2018-05-02 18:30:00 xx.xx.xx.xx POST /abc/xyz
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are looking at this all wrong. You shouldn't care what shows up in the log, only that Splunk can properly understand it. That is what the settings in props.conf do. If you KNOW that the TZ for the TZ-lacking timestamp is US/Eastern, then put that into props.conf for those hosts and deploy that ALL of your Indexers/HFs and reboot Splunk there. Now the _time value will be correct, regardless of what is in the event, and all Splunk operations work with _time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Possibly 🙂
i am the IIS guy and was assisting Splunk team in setting it up. It looks like the Propagation was not working for some reason. Setting it to TZ=UTC helped. thanks for suggestion.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, you should go ahead and click Accept to close the questions and let others know that there is a solution here.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And since you know the logs are in UTC, a correctly deployed props.conf with
[your sourcetype here]
TZ = UTC
should do the trick. Why your attempt to already implement that failed is another question. Maybe you didn't define the stanza properly, or didn't put it in the right place?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks, this worked.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Or didn't restart Splunk 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Or checked events from before the change, which should/will NOT be effected by the change; only events that are indexed after the change will show the change.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think this post answers your question
Happy Splunking !!
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
