Getting Data In

Exchange CAS IIS timezone conversion issue?

asofo
Path Finder

I'm working with Exchange IIS data from our CAS servers and am having trouble with Splunk translating the time from UTC to EST at indexing time. Looking into this, Splunk is supposed to translate the time zone using the local time of the universal forwarder host. This is the case for all other IIS data in my environment, except for the CAS logs. I've tried to hard set the TZ in my props config, but to no avail. This is causing a 5 hour delay in log visibility.

This is how I'm seeing the time in the CAS IIS event:
alt text

This is how I'm seeing the time in other IIS events and how I want to see the CAS event time:
alt text
Has anyone run into this issue, or have a way to solve it? If Splunk is already able to handle IIS data, what makes CAS IIS data so different that the same rules don't apply? For the record, the version we're running is 6.6.1.

0 Karma

woodcock
Esteemed Legend

You need to upgrade your forwarder. The documentation here:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Applytimezoneoffsetstotimestamps

says this:

If the forwarder and the receiving indexer are version 6.0 or later, use the time zone that the forwarder provides.

Then bounce your forwarder's Splunk instance(s).

The pre-v.6 way is to set a host-based stanza on your indexers to hardcode a value for TZ. Then bounce your indexers' Splunk instance(s).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...