Time zone config not working as expected

DavidCaputo — Wed, 05 Jul 2023 14:01:39 GMT

Hello,
I'm trying to configure an ingestion of logs that are in UTC time.
We are in Geneva and timezone is Europe/Zurich (=UTC+2), so, logs are displayed with the wrong date.

For example, log ingested at 14:52 today is displayed in Splunk like this :

2023-07-05 12:52:40 ..

These logs are coming from a simple UF (Windows, UF version is 8.2.4). My Splunk environment is Linux (RedHat 8 / Splunk version is 9.0.4)

As documented, I tried to add in a props.conf something like this :

[source::D:\path\to\file.log] TZ = Europe/Zurich

First I added it in the UF configuration. No effect.
Then I tried to put it on indexers. No effect.

I also tried to use the sourcetype name ([my_sourcetype] ) instead of the source path or replace the Europe\Zurich value with "TZ = UTC+2"... it didn't work any better.

Help would be appreciated !
Thanks
David

topic Time zone config not working as expected in Getting Data In

Time zone config not working as expected