Getting Data In

How to configure the timezone to prevent events from appearing in Splunk as 8 hours behind the present time?

responsys_cm
Builder

I have a light forwarder listening on tcp:514. It forwards data to three indexers, all of whose clocks are set to UTC time.

Several Cisco WSA proxy appliances are sending logs to the light forwarder. The WSAs don't support UTC time, so they are in US/Pacific and in Ireland.

Their syslog events arrive on tcp:514. A props/transforms identifies those events and changes the sourcetype to cisco:wsa:squid. It then routes that data to the "cisco" index rather than the "syslog" index.

The events are showing up in Splunk as being eight hours behind the present time.

I have tried:

[source::tcp:514]
TZ = US/Pacific

[cisco:wsa:squid]
TZ = US/Pacific

[host::10.10.10.10]
TZ = US/Pacific

And none of these work... I've also tried America/Los_Angeles, PDT, and PST. I feel like I'm taking crazy pills... what am I doing wrong?

0 Karma

mrgibbon
Contributor

Hi, this is a format for props.conf I have used before, it might help.

# Props.conf

[source::udp]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = false
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %b %d %H:%M:%S
TZ = America/Chicago

set the host as from the incoming udp packet

TRANSFORMS-gethostfromdata = set_host

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...