Getting Data In

timezone and Checkpoint logs

nov1ce
Explorer

Hello,

I'm using latest Splunk to collect event logs from a number of W2K8 servers as well as Checkpoint. Everything is working just fine except that if I search logs from Checkpoint in Splunk they appear to be two hours ahead (the time is correct, just two hours ahead). I double-checked system clock on the CP Management gateway and Splunk server - it's correct and synced. No issues with logs coming from Windows servers.

Seems like a timezone settings somewhere in Splunk but I can't find it.

PS: Setting timezone for a user didn't help.

Any hints would be greatly appreciated!

Thanks.

Tags (2)
0 Karma
1 Solution

tgow
Splunk Employee
Splunk Employee

The timezone (TZ) can be set in the props.conf file based on either host, source or sourcetype. Here is a quick example:

[host::nyc*]
TZ = US/Eastern

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/latest/Data/ApplyTimezoneOffsetsToTimeStamps

View solution in original post

tgow
Splunk Employee
Splunk Employee

The timezone (TZ) can be set in the props.conf file based on either host, source or sourcetype. Here is a quick example:

[host::nyc*]
TZ = US/Eastern

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/latest/Data/ApplyTimezoneOffsetsToTimeStamps

nov1ce
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...