https://community.splunk.com/t5/Getting-Data-In/Change-the-time-stamp-in-the-log-data-by-adding-2-Hours/m-p/521055#M88056 <P>The <FONT face="courier new,courier">TZ</FONT> setting specifies the time zone of the event, not the desired time zone.&nbsp; Set <FONT face="courier new,courier">TZ=UTC</FONT> so Splunk knows when the event occurred.&nbsp; At search time, it will convert the timestamp to your selected time zone.</P> Wed, 23 Sep 2020 12:54:56 GMT richgalloway 2020-09-23T12:54:56Z https://community.splunk.com/t5/Getting-Data-In/Change-the-time-stamp-in-the-log-data-by-adding-2-Hours/m-p/520970#M88042 <P><SPAN>hi All,</SPAN><SPAN>IN the AWS inputs logs we are getting timestamps behind 2 hours and we need to adjust it to UTC + 02:00 . I have applied it in&nbsp; in the props.conf on the HF where the aws input is configured as below</SPAN><SPAN>[source::s3:/cloudfx-s3/*]</SPAN><BR /><SPAN>TZ = UTC+02:00</SPAN><SPAN>But it didnt worked , Can someone please let me know if its the right way to adjust the Timestamp in the logs ?</SPAN></P><DIV><PRE>020-09-22 12:14:43 FCO50-C1 2253 5.171.196.19 GET d1q57ainn85gvl.TA_jvmjam.net /fe-api/v1/notifications 200 https://m.lego.it/scommesse-live Mozilla/5.0%20(Linux;%20Android%2010;%20Mi%209T%20Pro)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/85.0.4183.81%20Mobile%20Safari/537.36 =1600770582725 - Miss QumS5aHxkycZd-vjOLlapECGcIYloeTTUq4KursjmmdpHWotnCLDQ== m.lego.it https 2147 0.110 - TLSv1.3 TLS_AES_128_GCM_SHA256 Miss HTTP/2.0 - - 32299 0.110 Miss application/json;%20charset=utf-8 1895 - -</PRE></DIV><DIV><PRE> </PRE></DIV><DIV><PRE>2020-09-22 12:14:43 IAD66-C1 23128 157.55.39.108 GET d1q57ainn85gvl.TA_jvmjam.net /slot-machine/wild-rails/ 200 - Mozilla/5.0%20(compatible;%20bingbot/2.0;%20+http://www.bing.com/bingbot.htm) - - Miss jG0oTG9mljNfR0k-NQ5R6u_EWH0v0cggDlPDLfzmOgPEMMJrDHCtiQ== www.lego.it https 296 0.594 - TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 Miss HTTP/1.1 - - 13054 0.468 Miss text/html;%20charset=utf-8 22053 - <BR /><BR /><SPAN>Here it is 12:14:43 but we need it as +2H as 14:14:43</SPAN><BR /><BR /></PRE></DIV><P>&nbsp;</P> Wed, 23 Sep 2020 06:22:15 GMT https://community.splunk.com/t5/Getting-Data-In/Change-the-time-stamp-in-the-log-data-by-adding-2-Hours/m-p/520970#M88042 datamine 2020-09-23T06:22:15Z https://community.splunk.com/t5/Getting-Data-In/Change-the-time-stamp-in-the-log-data-by-adding-2-Hours/m-p/521055#M88056 <P>The <FONT face="courier new,courier">TZ</FONT> setting specifies the time zone of the event, not the desired time zone.&nbsp; Set <FONT face="courier new,courier">TZ=UTC</FONT> so Splunk knows when the event occurred.&nbsp; At search time, it will convert the timestamp to your selected time zone.</P> Wed, 23 Sep 2020 12:54:56 GMT https://community.splunk.com/t5/Getting-Data-In/Change-the-time-stamp-in-the-log-data-by-adding-2-Hours/m-p/521055#M88056 richgalloway 2020-09-23T12:54:56Z