https://community.splunk.com/t5/Getting-Data-In/Changing-syslog-timezone-to-Eastern-Standard-time/m-p/190205#M37868 <P>The problem is likely that you have overriden the <CODE>host</CODE> field and are trying to use your overriden/new <CODE>host</CODE> value in your <CODE>props.conf</CODE> stanza definition. This will not work. You must either use your original <CODE>host</CODE> value or use something else, such as <CODE>sourcetype</CODE> or <CODE>source</CODE>.</P> Tue, 19 May 2015 13:33:50 GMT woodcock 2015-05-19T13:33:50Z https://community.splunk.com/t5/Getting-Data-In/Changing-syslog-timezone-to-Eastern-Standard-time/m-p/190204#M37867 <P>I am having the same issue described here <A href="http://answers.splunk.com/answers/57543/splunk-displaying-events-with-the-correct-timezone.html">http://answers.splunk.com/answers/57543/splunk-displaying-events-with-the-correct-timezone.html</A>. </P> <P>My indexer is in EST and my syslog is coming from MST. I want the the indexer to change the logs from MST to EST. I have tried the suggested solution and that didn't solve the problem. Any other suggestions.</P> <P>Thanks in advance.</P> Mon, 18 May 2015 16:57:38 GMT https://community.splunk.com/t5/Getting-Data-In/Changing-syslog-timezone-to-Eastern-Standard-time/m-p/190204#M37867 fisan 2015-05-18T16:57:38Z https://community.splunk.com/t5/Getting-Data-In/Changing-syslog-timezone-to-Eastern-Standard-time/m-p/190205#M37868 <P>The problem is likely that you have overriden the <CODE>host</CODE> field and are trying to use your overriden/new <CODE>host</CODE> value in your <CODE>props.conf</CODE> stanza definition. This will not work. You must either use your original <CODE>host</CODE> value or use something else, such as <CODE>sourcetype</CODE> or <CODE>source</CODE>.</P> Tue, 19 May 2015 13:33:50 GMT https://community.splunk.com/t5/Getting-Data-In/Changing-syslog-timezone-to-Eastern-Standard-time/m-p/190205#M37868 woodcock 2015-05-19T13:33:50Z