https://community.splunk.com/t5/Getting-Data-In/Splunk-6-0-Ignoring-TZ-Offset/m-p/152942#M31148 <P>I figured out my problem. I modified format of syslog then edited props.conf to add "%z" to TIME_FORMAT in props.conf:</P> <P>TIME_FORMAT = %b %d %H:%M:%S %z</P> Fri, 22 Nov 2013 21:05:47 GMT trumpjk 2013-11-22T21:05:47Z https://community.splunk.com/t5/Getting-Data-In/Splunk-6-0-Ignoring-TZ-Offset/m-p/152941#M31147 <P>Prior to upgrading to Splunk 6 I had my props.conf configured to specify TZ's for certain host. Since upgrading to splunk 6 I noticed some entries are displaying and ordering in EST and others are still in GMT. Source of the entries are the same, syslog and in this instance I am not using splunkforwarder I am using syslog to forward to indexer. Props.conf I edited is in $SPLUNK_HOME/etc/system/local</P> Fri, 22 Nov 2013 19:07:50 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-6-0-Ignoring-TZ-Offset/m-p/152941#M31147 trumpjk 2013-11-22T19:07:50Z https://community.splunk.com/t5/Getting-Data-In/Splunk-6-0-Ignoring-TZ-Offset/m-p/152942#M31148 <P>I figured out my problem. I modified format of syslog then edited props.conf to add "%z" to TIME_FORMAT in props.conf:</P> <P>TIME_FORMAT = %b %d %H:%M:%S %z</P> Fri, 22 Nov 2013 21:05:47 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-6-0-Ignoring-TZ-Offset/m-p/152942#M31148 trumpjk 2013-11-22T21:05:47Z