We have a log that we've been asked to ingest which is a json format file that's similar to this:
{"type":"appRequest",
"severity":"INFO",
"eventid":"abcdefg1234567",
"userid":76965813945444,
"timezone":7,
"timestamp":"2019-10-30T23:57:59.958Z",
"logLevel":"INFO",
"url":"/some/url",
"diagnosticsEventId":"someEventId",
"startTime":1572479879958,
"logDetails":"200,OK"}
As you can see, the timezone is specified in a field instead of built into the timestamp string. I've look around to no avail, is there a way to specify the event timezone based on the timezone (this is offset to GMT in hours)?
The timestamp is of GMT format(Z at the end indicates time is GMT). Assuming that the source has actually put in the timestamp in GMT and not just stamped the local time with the GMT format, you could just ingest it as GMT. Based on the timezone set in your profile, Splunk would convert the timestamp to your local timestamp.
EDIT: I just converted the startTime field in https://www.epochconverter.com/ and it looks like the timestamp is actual GMT and not just local time stamped in GMT format.
Thank you. It's a misunderstanding on my part. I will confirm with our developer as well just to make sure.
The timestamp is of GMT format(Z at the end indicates time is GMT). Assuming that the source has actually put in the timestamp in GMT and not just stamped the local time with the GMT format, you could just ingest it as GMT. Based on the timezone set in your profile, Splunk would convert the timestamp to your local timestamp.
EDIT: I just converted the startTime field in https://www.epochconverter.com/ and it looks like the timestamp is actual GMT and not just local time stamped in GMT format.
I have this issue as well but without the benefit of logs in GMT. My logs are multiple time zones in a single host, index, source, sourcetype combo. Here's an example:
{ [-]
AppID:
ElapsedSeconds: 0.694 seconds
Event: RestCall
Method: POST
Request: { [+]
}
RequestLength: 371
RequestTimestamp: 16-Nov-2022 12:59:54
Response: { [+]
}
ResponseLength: 286
ResponseTimestamp: 16-Nov-2022 12:59:55
SequenceNumber: null
ServiceName:
ServiceURL:
StatusCode: 200
StatusText: OK
TimeZone: Asia/Shanghai
UserID:
UserIP: 127.0.0.1
UserName:
}
In total there are about 85 different timezones logging here. Any idea how to get Splunk to recognize the timezone when not with the time stamp?