I have a light forwarder listening on tcp:514. It forwards data to three indexers, all of whose clocks are set to UTC time.
Several Cisco WSA proxy appliances are sending logs to the light forwarder. The WSAs don't support UTC time, so they are in US/Pacific and in Ireland.
Their syslog events arrive on tcp:514. A props/transforms identifies those events and changes the sourcetype to cisco:wsa:squid. It then routes that data to the "cisco" index rather than the "syslog" index.
The events are showing up in Splunk as being eight hours behind the present time.
I have tried:
[source::tcp:514]
TZ = US/Pacific
[cisco:wsa:squid]
TZ = US/Pacific
[host::10.10.10.10]
TZ = US/Pacific
And none of these work... I've also tried America/Los_Angeles, PDT, and PST. I feel like I'm taking crazy pills... what am I doing wrong?
Hi, this is a format for props.conf I have used before, it might help.
# Props.conf
[source::udp]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = false
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %b %d %H:%M:%S
TZ = America/Chicago
TRANSFORMS-gethostfromdata = set_host