My system is in PST time and I noticed the SNMP poller injects UTC for it's logs.
I noticed that the poller injects it's own time using utcnow().
The resulting problem is my logging is now in the future.
Fix was easy. I created a props.conf file in app/local/
[snmp:if]
TZ=GMT
Then restarted Splunk.
Now the offset of my local splunk server time will correctly align with the poller logged data.
OK done.
thanks!
Awesome, thanks @pbalsley 🙂
Fix was easy. I created a props.conf file in app/local/
[snmp:if]
TZ=GMT
Then restarted Splunk.
Now the offset of my local splunk server time will correctly align with the poller logged data.
Hi @pbalsley
I second what @jkat54 says. Could you post the solution to the question as a formal answer below in the "Enter your answer here..." box, then Accept the answer? This will make it easier for other users to search for in results.
Can you separate this into question and answer so it doesn't appear to be an unanswered question forever?