A Universal Forwarder has the following active stanza in inputs . conf: [monitor: //var/log] disabled = O host = 460352847 An event from this input has a timestamp of 10:55. What timezone will…

The correct answer is D. The timezone of the forwarder. When Splunk parses a timestamp that lacks explicit timezone information, it applies the timezone of the host that collected the data - in this case, the Universal Forwarder. Splunk uses the forwarder's system timezone because that is where the log originated and was collected…

Splunk Forwarding

Question

A Universal Forwarder has the following active stanza in inputs . conf:

[monitor: //var/log] disabled = O host = 460352847 An event from this input has a timestamp of 10:55. What timezone will Splunk add to the event as part of indexing?

Options

AUniversal Coordinated Time.
BThe timezone of the search head.
CThe timezone of the indexer that indexed the event.
DThe timezone of the forwarder.

How the community answered

(53 responses)

A
2% (1)
C
4% (2)
D
94% (50)

Explanation

When Splunk parses a timestamp that lacks explicit timezone information, it applies the timezone of the host that collected the data - in this case, the Universal Forwarder. Splunk uses the forwarder's system timezone because that is where the log originated and was collected. The indexer's timezone, the search head's timezone, and UTC are not used by default unless explicitly configured via props.conf (e.g., the TZ setting). Since no TZ override is present in the shown inputs.conf stanza, the forwarder's local timezone is used.

Topics

#Forwarder Timezones#Data Ingestion#Event Timestamping

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice