@richgalloway , are you talking about forwarder service to be restarted? ... View more

Added TZ = US/Mountain to the exiting props but didn't worked that as well.  ... View more

Tried applying props, but didn't worked, same result TIME_PREFIX = ^\[ TIME_FORMAT = %m/%d/%y %H:%M:%S:%3N %Z SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)   ... View more

@woodcock , forwarder service was running and after service restart only data started flowing ... View more

hi @gcusello  thanks for quick response. So forwarder will never be inactive if there is no update in the file say for more than 20/30days and still will be able to see internal logs and if the re is an update after that time it should data without service restart ... View more

Yes, understands that it will wait for new data. But if there is no new data for a quite a long time so will forwarder be inactive and stop internal logs as well. So if there new data it is not flowing currently and after service restarts able to see data. What could be reason for this? ... View more

any recommendations? we need those extracted fields to be come under the event details same like below message , namespace_id , namespace_name , .....? ... View more

using the same consistent url in the drill down but still getting the pop up message. just for information this is coming after we had upgrade to 9.0.1 version from 8.2 ... View more

by any chance if we extract field "teamName", "ID " with the rex command can come under the event that pasted in the original post just like under message , namespace_id , namespace_name , .....? ... View more

where to find the button? sample event for ref. appid: 111111 cluster: abcdefgh container_id: c44444444444444444444455555555555566666 container_image: docker-dev-local.artifactrepository.**************.net/*********-project-111111/********************:master-55-c3444444 container_image_id: docker-dev-local.artifactrepository.********.net/*********-project-111111/******@s************************* container_name: ecs-*************** environment: dev hosting_env: ******* hostname: app-14.********.ecs.******* level: debug log_type: app_containers logroute: ******************* message: {"timestamp":"2023-03-30T12:29:51.684Z","msg":"REQUEST DATA : GET /generic/healthcheck, client=1.1.1.1]","logClass":"org.springframework.web.filter.CommonsRequestLoggingFilter","threadID":"http-nio-9099-exec-9","logLevel":"DEBUG","ID":"111111","teamName":"SL"} namespace_id: 00000000000000000000000000000 namespace_name: ************************ openshift: { [+] } ose_workload: dev pod_id: 1111111111111111111111111 pod_ip: 11.11.11.111 pod_name: ********************** sector: ******* timestamp: 2023-03-30T12:29:51.684743385+00:00 ... View more

it worked.... thank you.   ... View more

Tried, but it is removing all @ sign data from the event also wanted to have those entry as well in the event ... View more

tried adding settings in below file, but didn't worked tz=Asia/Singapore   /opt/splunk/splunk_sas/etc/apps/user-prefs/local/user-prefs.conf /opt/splunk/splunk_sas/etc/apps/TA_****_LDAP/default/user-prefs.conf   also tried in below file but no luck(only in default when added but not worked) /opt/splunk/splunk_sas/etc/apps/TA_****_LDAP/default/ui-prefs.conf [search] tz=Asia/Singapore dispatch.earliest_time = -4h dispatch.latest_time = now [default] tz=Asia/Singapore dispatch.earliest_time = -4h dispatch.latest_time = now   ... View more

seems provided link is not accessible. and tried adding in as well, but didn't worked. /opt/splunk/splunk_sas/etc/apps/user-prefs/local/user-prefs.conf [default] TZ=Asia/Singapore   As it is case sensitive, could let me know in which path/filename needs to be added? appreciate your feedback on this ... View more

Tried editing one by one in below files but didn't worked.  [default] TZ=Asia/Singapore   /opt/splunk/splunk_sas/etc/apps/user-prefs/default/user-prefs.conf /opt/splunk/splunk_sas/etc/apps/TA_****_LDAP/default/user-prefs.conf /opt/splunk/splunk_sas/etc/system/local/ui-prefs.conf ... View more

Okay. Now consider this case, if there is any no props settings applied and events are flowing to the index with TZ available in the logs with EDT/GMT and also SH is in that Zone too and other splunk components in the same zone  as well, so now if any user wants to view related events in ASIA TZ as if he change the user preference setting to Asia then will show the events in that TZ settings. So is there any possibility to change the default user preference setting to other which any user wants.   ... View more

okay, is there any precedence that will be considered here if applied TZ first and then DATETIME_CONFIG next?  Also, is there is any option to change the default Timezone for user settings in preference as Splunk components will be EDT/GMT TZ. ... View more