Getting Data In

timezone question

a212830
Champion

Hi,

I have a feed that sends messages using the UTC timezone. The timezone itself is never listed, but the vendor has assured me that this is the case (and it looks correct). Should I reference the timezone with a "TZ = UTC" in props.conf, or should I put a %T in the TIME_FORMAT, even though the timezone isn't in the message.

For example:

2014-01-14 23:54:17 1.2.3.4 message....

My props.conf has:

TIME_FORMAT = %Y-%m-%d %H:%M:%S
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TZ = UTC

or should it have:
TIME_FORMAT = %Y-%m-%d %H:%M:%S %T
SHOULD_LINEMERGE = false
TIME_PREFIX = ^

Update: it appears to be ignoring my timezone, regardless. As the event times are matching what is in the logs, and that should not be the case.

Tags (2)
0 Karma

lukejadamec
Super Champion

Try setting MAX_TIMESTAMP_LOOKAHEAD = 20 in your props.conf. That will keep Splunk from trying to interpret 1.2.3.4 as the TZ.

0 Karma

lukejadamec
Super Champion

What is your user default timezone? Splunk will adjust the search results based on the user timezone.
If no timezone is available in the event, then Splunk uses the indexer timezone. What is the indexer timezone?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...