https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80880#M16685 <P>You can set an explicit time format in <CODE>props.conf</CODE> and leave the timezone offset out.</P> <P>Take a look at: <BR /> &nbsp;&nbsp;&nbsp;&nbsp; <A href="http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition</A></P> <P>and look specifically at the TIME_FORMAT option.</P> Sat, 30 Oct 2010 03:17:29 GMT southeringtonp 2010-10-30T03:17:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80879#M16684 <P>Hi there,</P> <P>I have an application that is incorrectly reporting the current timezone is GMT -0500 with timestamps of the following form:</P> <P>[29/Oct/2010:15:59:50 -0500] </P> <P>(Currently we're on EDT which is -0400)</P> <P>Is there a way i can accept the timestamp but ignore the offset? Currently all events are marked an hour in the future?</P> <P>Thanks!</P> Sat, 30 Oct 2010 03:05:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80879#M16684 rrich 2010-10-30T03:05:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80880#M16685 <P>You can set an explicit time format in <CODE>props.conf</CODE> and leave the timezone offset out.</P> <P>Take a look at: <BR /> &nbsp;&nbsp;&nbsp;&nbsp; <A href="http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition</A></P> <P>and look specifically at the TIME_FORMAT option.</P> Sat, 30 Oct 2010 03:17:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80880#M16685 southeringtonp 2010-10-30T03:17:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80881#M16686 <P>Awesome. Thank you!</P> Sun, 31 Oct 2010 20:45:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80881#M16686 rrich 2010-10-31T20:45:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80882#M16687 <P>Updated docs URL, <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition">http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition</A></P> Wed, 08 Mar 2017 13:43:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ignore-timezone-offset-in-timestamp/m-p/80882#M16687 kmanson 2017-03-08T13:43:58Z