https://community.splunk.com/t5/Getting-Data-In/Set-Time-Zone-for-IIS-logs-4-2-3/m-p/78687#M16114 <P>I have added TZ=GMT to the props.conf under [iis] and restarted splunk. The Server is CST. <BR /> From what I have read the new indexed data will reference the new time. How do you reference the existing index data to the new time. I am having to adjust searches with "latest=+360m" to get current results.</P> Tue, 20 Sep 2011 15:43:01 GMT RaudeWoods 2011-09-20T15:43:01Z https://community.splunk.com/t5/Getting-Data-In/Set-Time-Zone-for-IIS-logs-4-2-3/m-p/78687#M16114 <P>I have added TZ=GMT to the props.conf under [iis] and restarted splunk. The Server is CST. <BR /> From what I have read the new indexed data will reference the new time. How do you reference the existing index data to the new time. I am having to adjust searches with "latest=+360m" to get current results.</P> Tue, 20 Sep 2011 15:43:01 GMT https://community.splunk.com/t5/Getting-Data-In/Set-Time-Zone-for-IIS-logs-4-2-3/m-p/78687#M16114 RaudeWoods 2011-09-20T15:43:01Z https://community.splunk.com/t5/Getting-Data-In/Set-Time-Zone-for-IIS-logs-4-2-3/m-p/78688#M16115 <P>You cannot fix/change the already indexed data. However, you could use the eval command to manipulate the old _time value so it is offset. So add to the search for the old data:</P> <PRE><CODE>| eval _time=_time-3600 </CODE></PRE> <P>The above would offset the time by -1 hour. You could programatically use if/case statements and the eval command to force a new time value for the older data.</P> Tue, 20 Sep 2011 21:41:40 GMT https://community.splunk.com/t5/Getting-Data-In/Set-Time-Zone-for-IIS-logs-4-2-3/m-p/78688#M16115 Simeon 2011-09-20T21:41:40Z