https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462583#M79822 <P>I have events which has EST timestamp already and i don't want splunk to do any time conversion.</P> <P>whats occurring right now is splunk is transforming this to EST again thinking its UTC time.</P> <P>raw event time- 02/05/2020 02:08:49.074<BR /> splunk timestamp - 2/4/20 9:08:49.074 PM</P> <P>i am looking to have no transformation applied and keep the raw event time as the timestamp<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8330i0A7F53D5ED76DB46/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 05 Feb 2020 21:44:42 GMT MOHITJOSHI 2020-02-05T21:44:42Z https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462583#M79822 <P>I have events which has EST timestamp already and i don't want splunk to do any time conversion.</P> <P>whats occurring right now is splunk is transforming this to EST again thinking its UTC time.</P> <P>raw event time- 02/05/2020 02:08:49.074<BR /> splunk timestamp - 2/4/20 9:08:49.074 PM</P> <P>i am looking to have no transformation applied and keep the raw event time as the timestamp<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8330i0A7F53D5ED76DB46/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 05 Feb 2020 21:44:42 GMT https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462583#M79822 MOHITJOSHI 2020-02-05T21:44:42Z https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462584#M79823 <P>Add <CODE>TZ = EST</CODE> to the appropriate props.conf stanza.</P> Wed, 05 Feb 2020 21:48:29 GMT https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462584#M79823 richgalloway 2020-02-05T21:48:29Z https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462585#M79824 <P>Tried that already but still the same.</P> <P>[mysourcetype]<BR /> TZ = EST</P> Wed, 05 Feb 2020 21:57:01 GMT https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462585#M79824 MOHITJOSHI 2020-02-05T21:57:01Z https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462586#M79825 <P>ah..i figured out...it needed a restart of splunk.</P> Wed, 05 Feb 2020 22:32:05 GMT https://community.splunk.com/t5/Getting-Data-In/Skipping-time-conversion/m-p/462586#M79825 MOHITJOSHI 2020-02-05T22:32:05Z