A Universal Forwarder has the following active stanza in inputs.conf: An event from this input has a timestamp of 10:55. What timezone will Splunk add to the event as part of indexing?

The correct answer is D. The timezone of the forwarder.. By default, Splunk uses the timezone of the host that generated and forwarded the data - in this case, the Universal Forwarder. When a UF monitors files or receives data, it stamps events with its own local timezone unless overridden by a 'TZ' setting in props.conf or transforms.

Splunk Forwarding

Question

A Universal Forwarder has the following active stanza in inputs.conf:

An event from this input has a timestamp of 10:55. What timezone will Splunk add to the event as part of indexing?

Exhibit

Options

AUniversal Coordinated Time.
BThe timezone of the indexer that indexed the event.
CThe timezone of the search head.
DThe timezone of the forwarder.

How the community answered

(31 responses)

A
6% (2)
B
3% (1)
C
3% (1)
D
87% (27)

Explanation

By default, Splunk uses the timezone of the host that generated and forwarded the data - in this case, the Universal Forwarder. When a UF monitors files or receives data, it stamps events with its own local timezone unless overridden by a 'TZ' setting in props.conf or transforms.conf on the indexer. This ensures that timestamps reflect when events actually occurred on the originating system. The indexer's timezone and the search head's timezone are irrelevant to timestamp normalization unless explicitly configured.

Topics

#Universal Forwarder#Timestamp extraction#Timezones#Data ingestion

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice