Hello, I have successfully integrated Cloudflare with Splunk Enterprise using the pull method. This integration was set up on a Heavy Forwarder, so the logs are first received by the HF before being...
See more...
Hello, I have successfully integrated Cloudflare with Splunk Enterprise using the pull method. This integration was set up on a Heavy Forwarder, so the logs are first received by the HF before being forwarded to the Indexers. While the integration itself is working correctly, I encountered an issue with the time zone in the logs. The API we are using requires the timestamps to be in UTC. As a result, when the API fetches the logs, the events are recorded in the UTC timezone. However, I need to convert these timestamps from UTC to UTC+5 (Pakistan Standard Time, PKT). Here is a sample log event from Cloudflare: " --- EdgeEndTimestamp: 2024-08-26T09:07:43Z EdgeResponseBytes: 72322 EdgeResponseStatus: 206 EdgeStartTimestamp: 2024-08-26T09:07:43Z --- " We are extracting the EdgeStartTimestamp and using it for the _time field, but this timestamp is in UTC format. In my props.conf file on the Heavy Forwarder, I have the following configuration: [cloudflare:json] disabled = false TIME_PREFIX = \"EdgeStartTimestamp\":\" TIME_FORMAT = %Y-%m-%dT%H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 19 I also tried adding the TZ setting to props.conf: [cloudflare:json] TZ = Asia/Karachi However, this didn't work because the events themselves contain timezone information (UTC), so the TZ setting doesn't have any effect. I then tried using TZ_ALIAS in props.conf: [cloudflare:json] TZ_ALIAS = Z=UTC+5 This didn't work either. Finally, I tried the following in props.conf, but it still didn't resolve the issue: [cloudflare:json] EVAL-_time = _time + 5*3600 Any help would be appreciated.