Getting Data In

rfc5424_syslog app + rfc5424 event = cannot parse the timezone from event

garrylean
Engager

Hello!

I have installed rfc5424-syslog_11.tgz on top of Splunk 7.2.6 enterprise.
I want to receive events from DIFFERENT timezones which comply with rfc 5424, like this:

<13>1 2019-04-26T01:57:19.000+08:00 Myhost.mydomain.com MyProduct - 4726 [MyProduct.Predefined@9999 RecordKey="97013316"... and after that follows the rest of the multiline event.

alt text

Everything works fine except the time zone. For the event above Splunk's showing the Time as 4/26/19 1:57:19.000 AM instead of 4/26/19 9:57:19.000 AM, as if I'm receiving events "from the past".
I tried to workaround using Splunk forum, like this:

C:\Program Files\Splunk\etc\apps\rfc5424\local\props.conf:

[rfc5424_syslog]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)(?=<13>\d+\s+)
TIME_PREFIX = ^<13>\d+\s+
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 30

But it does not help to treat the time as 4/26/19 9:57:19.000 AM.
What do I miss?
Thank you!

0 Karma
1 Solution

whrg
Motivator

Hello @garrylean,
This event has the timestamp 2AM (UTC+08:00).
When Splunk parses the timestamp, it will save all events in epoch time.
Now when you run a Splunk search, the _time field will display the events in your local time. In your case, that is UTC+-00:00, thus 10 AM.
Your user's time zone can be set when you click on your username at the top and then on "Preferences".

EDIT: See my comment below for the actual solution.

View solution in original post

0 Karma

FrankVl
Ultra Champion

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%:z does not match 2019-04-26T01:57:19.000+08:00. There is no : before the timezone indicator. Try TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z

0 Karma

whrg
Motivator

Hello @garrylean,
This event has the timestamp 2AM (UTC+08:00).
When Splunk parses the timestamp, it will save all events in epoch time.
Now when you run a Splunk search, the _time field will display the events in your local time. In your case, that is UTC+-00:00, thus 10 AM.
Your user's time zone can be set when you click on your username at the top and then on "Preferences".

EDIT: See my comment below for the actual solution.

0 Karma

garrylean
Engager

Pardon?
My time zone setting is "Default System Timezone", which is actually +8.
I have the simplest scenario, this event happened around 10 AM in my TZ, and was sent by the Sender from the same TZ, and Splunk host is also in the same TZ, but in the Time column I see "4/26/19 1:57:19.000 AM"

0 Karma

whrg
Motivator

Then I believe your server (which generates the logs) has misconfigured time settings.
If the server's time zone is +8 and this event is generated at 10 AM in your local time, then the event should read "<13>1 2019-04-26T09:57:19.000+08:00"
If you are running Linux, check your server via the command "timedatectl".

garrylean
Engager

Oh my, Splunk works fine, the original date was not correct indeed!
You helped to figure it out, thank you!
If we can convert your comment above to a correct answer?

0 Karma

whrg
Motivator

@garrylean Glad to hear I could help.
I edited my original answer to point to my comment.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...