Hi,
I have a stanza below defined in transforms.conf.
[wip_fields]
DELIMS = ","
FIELDS = timestamp,wip,vip
Strangely, the event time is not consistent with the timestamp in each record. It seems the event time is always 5 hours ahead of the timestamp. I suspect I need to set the timezone explicitly? Please share some thoughts or suggestion. Thanks!
table _time,timestamp
8/20/12 4:30:17.000 AM 08/20/2012 09:30:17
If the system parsing the events (normally the indexer, but could be a heavy forwarder) is in a different timezone than the data being indexed, then you will need to provide a TZ
offset. Use a props.conf
config entry of the form:
[sourcetype]
TZ=America/Chicago
This is an index-time setting so you will have to reload previously indexed data.
If the system parsing the events (normally the indexer, but could be a heavy forwarder) is in a different timezone than the data being indexed, then you will need to provide a TZ
offset. Use a props.conf
config entry of the form:
[sourcetype]
TZ=America/Chicago
This is an index-time setting so you will have to reload previously indexed data.