Logs are delayed due to a time zone issue; which parser-related action is recommended?

• A. Modify the default parser and include a default time zone.
• B. Create a custom parser to correct the time zone.
• C. Create a parser extension to correct the time zone.
• D. Modify the UI settings to correct the time zone.

Answer: (C)

When timestamps arrive with a time-zone mismatch, fix the interpretation at the parsing stage so the logs are ingested with the correct, normalized time. A parser extension lets you augment the existing parser for a specific log source to apply the correct time zone behavior without touching the global parsing logic or building a full custom parser. This targets the exact issue—how timestamps are read and interpreted—without risking side effects across all logs handled by the default parser.

Modifying the default parser would affect all logs and could introduce unintended changes elsewhere. Creating a custom parser would be heavier work, require ongoing maintenance, and might duplicate functionality already provided by the built-in parsing mechanisms. Changing UI settings only affects how timestamps are displayed, not how they are parsed or stored during ingestion, so it won’t resolve the underlying delay caused by misparsed times. The parser extension approach provides a precise, maintainable way to correct the time zone during ingestion and eliminate the timezone-related delays.