All Apps and Add-ons

wrong time in last connected OPSEC LEA

bhanu22
Engager

In the OPSEC LEA LOGGRABBER APP for checkpoint the time shown in "last connected" is incorrect.
I have the Splunk server running in UTC while I access the Splunk Web interface to create the connection from Singapore it shows me the last connected time in SGT but with future time.
That is SGT is UTC + 8 so the last connected shown in SGT should be local time of Singapore but however the last connected shown to me is UTC + 16 i.e. SGT + 8, hence the OPSEC LEA app is showing me last connected time incorrect. I have confirmed Splunk server, Checkpoint CMA, Gateway and provider-1 all are running in UTC.
Can some one please help me in this issue, I have gone through the Splunk configs no where I have configured any custom timezones, its set to use the local server time.

1 Solution

amarsaroj
Explorer

Checkpoint App Version: 1.11.1

This issue is seen when the server where the checkpoint app is setup (usually forwarder) and the user location viewing the 'Manage Connections' fall in different timezone.

Looks like the ajax script controlling the opsec app, is calculating the Date() incorrectly. The Date function which operates on 'data.last_time' (which is epoch time of last connection time) is using the offset parameter unnecessarily. Removing the offset solved the issue.

AJAX file location: $app path/appserver/static/opsec.js';
function: getConnInfo()

EDIT:
d = new Date(data.last_time*1000 - offset);

TO:
d = new Date(data.last_time*1000);

Note: Removal of the browser cache maybe required for the changes to take effect.

View solution in original post

amarsaroj
Explorer

Checkpoint App Version: 1.11.1

This issue is seen when the server where the checkpoint app is setup (usually forwarder) and the user location viewing the 'Manage Connections' fall in different timezone.

Looks like the ajax script controlling the opsec app, is calculating the Date() incorrectly. The Date function which operates on 'data.last_time' (which is epoch time of last connection time) is using the offset parameter unnecessarily. Removing the offset solved the issue.

AJAX file location: $app path/appserver/static/opsec.js';
function: getConnInfo()

EDIT:
d = new Date(data.last_time*1000 - offset);

TO:
d = new Date(data.last_time*1000);

Note: Removal of the browser cache maybe required for the changes to take effect.

amarsaroj
Explorer

Firefox 14.0.1

0 Karma

araitz
Splunk Employee
Splunk Employee

Nice! I filed OPSEC-125 for this issue. What browser were you using?

0 Karma

bhanu22
Engager

thanks it fixed the issue

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...