https://community.splunk.com/t5/Getting-Data-In/TZ-Settings/m-p/56905#M11093 <P>You can use a regex to match a set of hosts...have you looked at <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Applytimezoneoffsetstotimestamps">specify time zones of timestamps</A> in the Getting Data In manual? The example there is pretty close to your situation, if I am understanding you correctly.</P> Fri, 06 Sep 2013 21:33:04 GMT ChrisG 2013-09-06T21:33:04Z https://community.splunk.com/t5/Getting-Data-In/TZ-Settings/m-p/56904#M11092 <P>I have systems that forward logs via syslog-ng to my splunk server. Systems are in different TZ's mix of EDT and GMT my splunk server/indexer is in EDT. I have the TZ offset displayed in log entries being sent to splunk server. Two questions will splunk read TZ offset and display indexed entries in EDT without me having to put an entry for each host in the props.conf? If splunk will do automatically is there a certain postion the TZ offset has to be in? Current format: Sep 6 15:38:14 hostname +00:00</P> Fri, 06 Sep 2013 15:46:55 GMT https://community.splunk.com/t5/Getting-Data-In/TZ-Settings/m-p/56904#M11092 trumpjk 2013-09-06T15:46:55Z https://community.splunk.com/t5/Getting-Data-In/TZ-Settings/m-p/56905#M11093 <P>You can use a regex to match a set of hosts...have you looked at <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Applytimezoneoffsetstotimestamps">specify time zones of timestamps</A> in the Getting Data In manual? The example there is pretty close to your situation, if I am understanding you correctly.</P> Fri, 06 Sep 2013 21:33:04 GMT https://community.splunk.com/t5/Getting-Data-In/TZ-Settings/m-p/56905#M11093 ChrisG 2013-09-06T21:33:04Z