I'm in the exact same boat, guys. I put in just: | tstats summariesonly=t count FROM datamodel="pan_firewall" And I get data. When I put in: | tstats summariesonly=t count FROM datamodel="pan_firewall" WHERE nodename="log.correlation" GROUPBY log.severity log.threat_category log.threat_name I get nothing. I tried adding each argument in from the beginning and it immediately fails at the nodename designation. Thoughts?
... View more
TZ = <timezone identifier>
* The algorithm for determining the time zone for a particular event is as
* If the event has a timezone in its raw text (for example, UTC, -08:00),
* If TZ is set to a valid timezone string, use that.
Based on that, it will only use the TZ setting, if the TZ is not found in the event.
You event has a valid TZ of +1000, which Splunk is applying causing the time to 06:19:27 + 1000 = 16:19:27
If you want it to ignore the timezone set in the timestamp, I believe you will need to configure a custom timestamp extraction for this sourcetype in props.conf:
TIME_FORMAT = <strptime-style format>
* Specifies a "strptime" format string to extract the date.
Although the real fix, is to correct the time on the end device.
You could also have the device sent to a syslog server, that syslog server could apply the timestamp you want as it writes to file, and Splunk can monitor the syslog files.
As long as the latency between your endpoints and syslog servers are low, the timestamps should be close enough and all normalized your specified timezone.
... View more