Getting Data In

Splunk timezone change for a specific sourcetye

kteng2024
Path Finder

Hi,

I am using the timezone converting attribute " _tzhint" to convert EDT to UTC . This attribute was able to convert events timestamp to UTC but it is only converting only very few events, but not all. Below is the how configuration looks. when I use "TZ=UTC" splunk is not converting to UTC timezone , it is still using system time that is the reason I used _tzhint

[monitor:///web/appache.log]
disabled = false
followTail = 0
_tzhint=UTC
index = apache_web
sourcetype=web_logs

0 Karma

bsriramineni_sp
Splunk Employee
Splunk Employee

"_tzhint"needs to be removed. It is not a documented feature and it was only used in splunk STORM which was the precursor to Cloud. It is NOT supported. So it won't change the logs timestamp.

Analyse your logs and set proper values for the below parameters in props.conf file.

[web_logs]
TIME_PREFIX = link text
MAX_TIMESTAMP_LOOKAHEAD = link text
TIME_FORMAT = link text
TZ = UTC

The above configuration should fix this issue.

For more details, refer the below links:

http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf#Timestamp_extraction_configuration

http://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps

http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Configurepositionaltimestampextraction

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...