Events Not Appearing in Splunk Due to Autotimestamp Timezone Mismatch in Stream

Symptom

Events from Zscaler web feed are not appearing in Splunk Cloud when searching with a time-based lookback window. However, data shows via Live Capture on the Splunk HEC destination in Stream.

Environment

• Stream 4.17.0
• Zscaler Cloud NSS (HEC Source)
• Splunk Cloud (HEC Destination)
• Autotimestamp function in pipeline

Resolution

1. Use Live Capture on the HEC Destination to compare event timestamps against local time.
2. Review _raw or _time for timezone.
3. Adjust the Autotimestamp function's default timezone to UTC (or the appropriate timezone for the source data).

Cause

Zscaler web feed _raw datetime field contains no timezone indicator - no offset (+00:00) or Z (for UTC). The Autotimestamp function was configured to CDT, causing events to be stamped with an incorrect offset. This results in future-stamped events relative to the user's local time, making it appear the events are not arriving to Splunk when using a time-based search.

Last Validated

4.17.0

Additional Information

This applies to any source sending timestamps without timezone context, not just Zscaler.