[BUG] The "timezone" parameter doesn't work with "now" timestamps

[hexecute]

Describe the bug The timezone parameter doesn't do anything with "now" timestamps. The code is trying to change the timezone in these lines in timeParser [1], but it's relying on the now and utcnow parameters. If you look through the repo [2], timeParser is never passed these two parameters in the library. Hence, timeParser always uses datetime.datetime.now(), regardless of what the timezone parameter is.

[1] https://github.com/splunk/eventgen/blob/710da6e5b5e9c79789c2f592ade0657cbccef17e/splunk_eventgen/lib/timeparser.py#L25-L36 [2] https://github.com/splunk/eventgen/search?q=timeParser&unscoped_q=timeParser

To Reproduce

1. Set "timezone" in eventgen.conf to something
2. Replay the events

Expected behavior The events should output in a new timezone.

Actual behavior The events output in the same timezone.

Sample files and eventgen.conf file

[1561419615_3551.csv]                                                                
mode = replay
sampletype = csv
outputMode = stdout
timeField = _time
autotimestamp = true
timezone = +1234

Do you run eventgen with SA-eventgen? No.

If you are using eventgen with pip module mode (please complete the following information):

• python version: 2.7
• OS: MacOS High Sierra
• Virtual Env is used: Yes
• Eventgen Version 6.3.5

Additional context You can Slack me. I work at Splunk.

[li-wu]

@hexecute In eventgensamples.py here: https://github.com/splunk/eventgen/blob/develop/splunk_eventgen/lib/eventgensamples.py#L221, the now function already deals with timezone.

You want to replay a csv sample file with _time field as timestamp and output events with correct timezone timestamp? Could you share your sample file?

[hexecute]

@li-wu I've attached the .conf (which I modified) which uses a sample file in the repo (sample.tutorial1). You can test this by switching the timezone parameter around and re-running. The events created have the same timestamp, no matter what the timezone parameter is.

test.conf.txt

[li-wu]

@hexecute , thanks for the info.