Getting Data In

Timestamp not Reflecting Timezone Configuration

rturk
Builder

Hi Splunkers & Splunkettes!

So I have a series of devices that logs in UTC as follows:

2011-10-30 23:24:13 0 2 0 0 N 1440 2473 402 249 0.00 0.00 435314688 0 0 0 0 0 8 

I want ensure Splunk treats this as UTC value when searches are run, so I have ensured that TZ = UTC is in the relevant props.conffiles (Yes I have checked the configuration hierarchy).

Despite this, when searches are run, the time stamp doesn't reflect the local time changes:

Splunk Timestamp                Event Timestamp
10/30/11 11:25:01.000 PM        2011-10-30 23:25:01 ...

This is despite other identically configured timestamps reflecting the desired timezone:

Splunk Timestamp                Event Timestamp
10/31/11 10:29:56.000 AM        [30/Oct/2011:23:21:37.560+0000] ...

This is doing my head in, so any and all assistance appreciated!!

Tags (2)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

The answer might be that your search head is not in UTC timezone. Splunk uses TZ= in props.conf to figure out what offset to apply to _time during indexing. But, at display time, _time is formatted from a time_t to a string in the search head's local timezone.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The answer might be that your search head is not in UTC timezone. Splunk uses TZ= in props.conf to figure out what offset to apply to _time during indexing. But, at display time, _time is formatted from a time_t to a string in the search head's local timezone.

View solution in original post

rturk
Builder

This was indeed the case! Thanks for the answer 🙂

0 Karma

e82than
Communicator

what's your props.conf? post a copy. You may have got your config hierarchy correct, but the events to point to the stanza is?

e.g here
http://splunk-base.splunk.com/answers/29218/filtering-windows-event-logs

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!