https://community.splunk.com/t5/Getting-Data-In/Unable-to-recognize-the-correct-timezone-from-Forwarder-on/m-p/184382#M36935 <P>An enhancement request has been filed but no commit yet</P> Fri, 27 Dec 2013 21:00:57 GMT uuppuluri_splun 2013-12-27T21:00:57Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-recognize-the-correct-timezone-from-Forwarder-on/m-p/184381#M36934 <P>Hi !</P> <P>I am having problem collecting logs from windows server 2008R2 .<BR /> The timezone are always the same with the one on Splunk server (ver 5.0.5).</P> <P>I have tried to use TZ setting with host stanza but didn't work. But I confirmed that <BR /> if you force to change the _time with EVAL parameter in props.conf it does work.</P> <P>[host::WIN-M02LJSSWVMU]</P> <H1>TZ = UTC</H1> <P>EVAL-_time = _time- 32400</P> <P>I appreciate if someone can share workaround to make splunk server recognize the timezone<BR /> correctly from the forwarder on windows OS.</P> <P>I asked this question because I wasn't sure if the below link is already commited to splunk or not.<BR /> <A href="http://answers.splunk.com/answers/9747/are-windows-eventlogs-from-windows-forwarder-lacking-timezone">http://answers.splunk.com/answers/9747/are-windows-eventlogs-from-windows-forwarder-lacking-timezone</A></P> Thu, 19 Dec 2013 00:29:23 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-recognize-the-correct-timezone-from-Forwarder-on/m-p/184381#M36934 yuwtennis 2013-12-19T00:29:23Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-recognize-the-correct-timezone-from-Forwarder-on/m-p/184382#M36935 <P>An enhancement request has been filed but no commit yet</P> Fri, 27 Dec 2013 21:00:57 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-recognize-the-correct-timezone-from-Forwarder-on/m-p/184382#M36935 uuppuluri_splun 2013-12-27T21:00:57Z