https://community.splunk.com/t5/Getting-Data-In/How-to-change-time-from-GMT-to-EST-after-ingesting-IIS-logs/m-p/439066#M76557 <P>Hello @satyaallaparthi,</P> <P>You need to understand that TZ does not work at search time. All event timestamps stored in GMT epoch in Splunk. When you search the data it will be converted to timezone of your user preference.</P> <P>TZ works at index-time, whatever timestamp Splunk extract from raw event that will all be considered to be in EST timezone (as specified in TZ). Then it converted from EST to GMT epoch and stored.</P> <P>I hope you understand this. Once you understand this first check whether based on this concept have you set correct TZ? If yes then after check your user-preference timezone. Let me know if you have any other questions.</P> Mon, 24 Jun 2019 14:23:12 GMT VatsalJagani 2019-06-24T14:23:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-time-from-GMT-to-EST-after-ingesting-IIS-logs/m-p/439065#M76556 <P>Hello, </P> <P>Need a help in changing time from (GMT+2) to EST. </P> <P>When ever I am searching with 24 hours time frame then I am getting latest event with EST time. But, When ever I am changing to all time then I am getting the latest event with Germany time. </P> <P>I tried props.conf with </P> <PRE><CODE>[iis] TZ = EST </CODE></PRE> <P>and </P> <PRE><CODE>[iis] TZ_ALIAS = EST=GMT+10:00 </CODE></PRE> <P>But both are not working.. Can any one help me with that?</P> <P>Thanks in advance.</P> Mon, 24 Jun 2019 13:55:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-time-from-GMT-to-EST-after-ingesting-IIS-logs/m-p/439065#M76556 satyaallaparthi 2019-06-24T13:55:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-time-from-GMT-to-EST-after-ingesting-IIS-logs/m-p/439066#M76557 <P>Hello @satyaallaparthi,</P> <P>You need to understand that TZ does not work at search time. All event timestamps stored in GMT epoch in Splunk. When you search the data it will be converted to timezone of your user preference.</P> <P>TZ works at index-time, whatever timestamp Splunk extract from raw event that will all be considered to be in EST timezone (as specified in TZ). Then it converted from EST to GMT epoch and stored.</P> <P>I hope you understand this. Once you understand this first check whether based on this concept have you set correct TZ? If yes then after check your user-preference timezone. Let me know if you have any other questions.</P> Mon, 24 Jun 2019 14:23:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-time-from-GMT-to-EST-after-ingesting-IIS-logs/m-p/439066#M76557 VatsalJagani 2019-06-24T14:23:12Z