Closed chipzzz closed 9 months ago
@chipzzz can you please attach zip-archive with all your custom (local) configs? We need it to reproduce your case. You can send me on email: ikheifets@splunk.com
We can close this I was able to set this up with a separate block parser
Okay @chipzzz , if it's resolved then I closing that
Was the issue replicated by support? No What is the sc4s version ? 3.4.0 Is there a pcap available? no Is the issue related to the environment of the customer or Software related issue? no Is it related to Data loss, please explain ? Protocol? Hardware specs? no Last chance index/Fallback index? present Is the issue related to local customization? yes Do we have all the default indexes created? yes Describe the bug Trying to fix timzene issues using https://splunk.github.io/splunk-connect-for-syslog/main/troubleshooting/troubleshoot_resources/#fix-timezone
My working config:
I'm adding:
and
FInal Config:
Getting Error: