Getting Data In

How do I extract a timezone expressed as the difference in minutes between UTC and local time?

erikawaldinger
Engager

I am trying to configure timestamp format for a db2diag log file, and I am having trouble reading the timezone since it's in a weird format.

This is what the documentation for db2diag log files says about the timezone:
Timestamps in the db2diag log files contain a time zone. For example: 2006-02-13-14.34.35.965000-300, where "-300" is the difference between UTC (Coordinated Universal Time, formerly known as GMT) and local time at the application server in minutes. Thus -300 represents UTC - 5 hours, for example, EST (Eastern Standard Time).

Is there a way I can make Splunk recognize this as a timezone instead of saying it is an "invalid timezone specifier"?

0 Karma

woodcock
Esteemed Legend

Have you tried this in props.conf on your indexer using a sourcetype stanza header?

#2006-02-13-14.34.35.965000-300
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d-%H.%M.%S.%6N%z
MAX_TIMESTAMP_LOOKAHEAD = 30
0 Karma

eashwar
Communicator

I hope you have to add a stanza to related sourcetype in the props.conf in the local directory.

TZ = UTC

if splunk does not recognize the timestamp you have to configure it yourself.
if you dont know to configure the time stamp, you have to add a sample event to your question so that we will help you configure it.

happy splunking!!

0 Karma

MuS
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...