I finally managed to make it work by manually assigning TZ to sourcetype in props.conf on HF.  Thank you @isoutamo ! ... View more

My app always uses UTC to put a timestamp. However, I always managed to use index time to display events correctly (ignoring app timestamp), but not in this case. As I said before, the logs are being displayed correctly from my lab system (the same app, the same timestamp set).  Weird.   ... View more

Do you mean "search and reporting" app? The only thing I can do is the restart Splunk cloud instance. Is it right?  ... View more

[root@xxx ~]# clock Fri 21 Jul 2023 16:15:09 BST -0.286435 seconds [root@xxx ~]# tail -n 10 /opt/videoipath/logs/backend/main.log 2023-07-21 15:15:12,326 backend_2023.2.5: INFO content 2023-07-21 15:16:48,011 backend_2023.2.5: INFO content  And below is how logs are being visible in GUI   ... View more

Would this be enough?  [SSL] _rcvbuf = 1572864 allowSslRenegotiation = true certLogMaxCacheEntries = 10000 certLogRepeatFrequency = 1d cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 host = $decideOnStartup index = default logCertificateData = true sslQuietShutdown = false sslVersions = tls1.2 [batch:///opt/splunkforwarder/var/run/splunk/search_telemetry/*search_telemetry.json] _rcvbuf = 1572864 crcSalt = <SOURCE> host = $decideOnStartup index = _introspection log_on_completion = 0 move_policy = sinkhole sourcetype = search_telemetry [batch:///opt/splunkforwarder/var/spool/splunk] _rcvbuf = 1572864 crcSalt = <SOURCE> host = $decideOnStartup index = default move_policy = sinkhole [batch:///opt/splunkforwarder/var/spool/splunk/...stash_hec] _rcvbuf = 1572864 crcSalt = <SOURCE> host = $decideOnStartup index = default move_policy = sinkhole sourcetype = stash_hec [batch:///opt/splunkforwarder/var/spool/splunk/...stash_new] _rcvbuf = 1572864 crcSalt = <SOURCE> host = $decideOnStartup index = default move_policy = sinkhole queue = stashparsing sourcetype = stash_new time_before_close = 0 [batch:///opt/splunkforwarder/var/spool/splunk/tracker.log*] _rcvbuf = 1572864 host = $decideOnStartup index = _internal move_policy = sinkhole sourcetype = splunkd_latency_tracker [blacklist:/opt/splunkforwarder/etc/auth] _rcvbuf = 1572864 host = $decideOnStartup index = default [blacklist:/opt/splunkforwarder/etc/passwd] _rcvbuf = 1572864 host = $decideOnStartup index = default [fschange:/opt/splunkforwarder/etc] _rcvbuf = 1572864 delayInMills = 100 disabled = false filesPerDelay = 10 followLinks = false fullEvent = false hashMaxSize = -1 host = $decideOnStartup index = default pollPeriod = 600 recurse = true sendEventMaxSize = -1 signedaudit = true [http] _rcvbuf = 1572864 ackIdleCleanup = true allowSslCompression = true allowSslRenegotiation = true dedicatedIoThreads = 2 disabled = 1 enableSSL = 1 host = $decideOnStartup index = default maxSockets = 0 maxThreads = 0 port = 8088 sslVersions = *,-ssl2 useDeploymentServer = 0 [monitor:///opt/splunkforwarder/etc/splunk.version] _TCP_ROUTING = * _rcvbuf = 1572864 host = $decideOnStartup index = _internal sourcetype = splunk_version [monitor:///opt/splunkforwarder/var/log/splunk] _rcvbuf = 1572864 host = $decideOnStartup index = _internal [monitor:///opt/splunkforwarder/var/log/splunk/configuration_change.log] _rcvbuf = 1572864 host = $decideOnStartup index = _configtracker [monitor:///opt/splunkforwarder/var/log/splunk/license_usage_summary.log] _rcvbuf = 1572864 host = $decideOnStartup index = _telemetry [monitor:///opt/splunkforwarder/var/log/splunk/metrics.log] _TCP_ROUTING = * _rcvbuf = 1572864 host = $decideOnStartup index = _internal [monitor:///opt/splunkforwarder/var/log/splunk/splunk_instrumentation_cloud.log*] _rcvbuf = 1572864 host = $decideOnStartup index = _telemetry sourcetype = splunk_cloud_telemetry [monitor:///opt/splunkforwarder/var/log/splunk/splunkd.log] _TCP_ROUTING = * _rcvbuf = 1572864 host = $decideOnStartup index = _internal [monitor:///opt/splunkforwarder/var/log/watchdog/watchdog.log*] _rcvbuf = 1572864 host = $decideOnStartup index = _internal [monitor:///opt/videoipath/logs/backend/main.log] _rcvbuf = 1572864 disabled = false host = $decideOnStartup index = discol2 sourcetype = main_demo [script] _rcvbuf = 1572864 host = $decideOnStartup index = default interval = 60.0 start_by_shell = true [splunktcp] _rcvbuf = 1572864 acceptFrom = * connection_host = ip host = $decideOnStartup index = default route = has_key:tautology:parsingQueue;absent_key:tautology:parsingQueue [tcp] _rcvbuf = 1572864 acceptFrom = * connection_host = dns host = $decideOnStartup index = default [udp] _rcvbuf = 1572864 connection_host = ip host = $decideOnStartup index = default ... View more

Hi Ismo,  Below is TZ set on UF server. Interestingly I set the same time zone on my local test server and after changing timestamp settings to "current time" the logs are displaying in time. However, it's a simple UF->Cloud setup as opposed to productional one (through HF). timedatectl Local time: Fri 2023-07-21 13:27:32 BST Universal time: Fri 2023-07-21 12:27:32 UTC RTC time: Fri 2023-07-21 12:27:32 Time zone: Europe/London (BST, +0100) NTP enabled: yes NTP synchronized: yes RTC in local TZ: no DST active: yes Last DST change: DST began at Sun 2023-03-26 00:59:59 GMT Sun 2023-03-26 02:00:00 BST Next DST change: DST ends (the clock jumps one hour backwards) at Sun 2023-10-29 01:59:59 BST Sun 2023-10-29 01:00:00 GMT Not sure how to grab log event on UF (this sounds like from Windows world). regards, Sz ... View more

@bowesmana You nail it! I had to play with regex a little bit, but I managed to achieve what I wanted.  Thanks a lot.  ... View more

Dear @bowesmana  Apologies for not being entirely clear in previous messages. No wonder you got confused. Let me clarify this again. I got logs: Splunk_timestamp EventA time_used [249.34ms] Splunk_timestamp EventB time_used [246.23ms] Splunk_timestamp EventC time_used [323.11ms] Splunk_timestamp EventA time_used [1445.12ms]  I managed to extract time_used value per event.  I would like to have a total sum of time_used from all events per hour.  The next step would be having percentage of time_used total number/number of ms in day i.e. (3 600 000 ms - 1000ms*60*60).  My query was a crap, so I'm not attaching it here.  ... View more

Hi,   I don't take into account the timestamp at the beginning of every line. Relying on Splunk-added timestamp is okay.  716906.314 - 716920.165  I'm struggling with an accumulation of time  in ms at the end of every log line like: 24.051   3124.593   and divide it into hours (Splunk timestampt)  ... View more

I've already given it a go (not in props.conf, but in the sourcetype edit tab in GUI - I'm using cloud premise).  It doesn't break lines correctly.    ... View more