Skip to main content
Question

Change timestamp on incoming logs

  • 25 June 2024
  • 2 replies
  • 84 views

Hi!

I’ve several logs that comes in UTC timeformat. My timezone Is UTC + 2. Which mess things up when I perform querys, hunting, analyzing events and taking out reports.

My log Exporters often send syslog in UTC timeformat, RFC-compliant behavior.

Is It possible to apply any sort of Normalization Package for these incoming logs to fix this?
Can I try with some querys that changes the log_ts & col_ts field to UTC +2 timezone? Instead of the default UTC timezone.

Thanks

2 replies

Nils Krumey
Rank
Userlevel 4
Badge +7

This is usually best fixed through the time zone settings in the device you are ingesting the logs from, and additionally you need to have the correct time zone configured for your Logpoint server AND the user you are logged in as.

Kind Regards, Nils
A

Hi @Nils Krumey 

Thanks for your answer.

I have the right time zone settings in the devices that I’m ingesting logs from. All of them är set to,
(GMT+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna.

Checked my Date/Time Preference under “My Preference”. Have the same timezone as abow.

In some way It seems like It shows the right time in Logpoint now. The log_ts and col_ts field are now correct. Interesting that It suddenly worked. Yesterday the log_ts & col_ts were 2hours behind of my actual time.

Thanks anyways!

Reply


Terms & ConditionsCookie settings