https://community.splunk.com/t5/Getting-Data-In/Event-times-for-specific-log-file-are-incorrect/m-p/542393#M90628 <P>You have full control over your HF so you can install any app you need on it.&nbsp; If the app you want to use is outdated then update it yourself - that's why every app has a 'local' folder.</P><P>Do check the props.conf settings to ensure any time zones in the events are recognized properly.&nbsp; Use the TZ attribute for those sources that don't provide one.</P> Thu, 04 Mar 2021 17:52:38 GMT richgalloway 2021-03-04T17:52:38Z https://community.splunk.com/t5/Getting-Data-In/Event-times-for-specific-log-file-are-incorrect/m-p/542382#M90627 <P>Hello,</P><P>I am encountering an issue with the event times for a specific set of logs.&nbsp; We have been using Splunk Cloud for a little over a year now and I haven't experienced this issue with other sources/data.</P><P>Most of the servers are located in PST and the events are being logged UTC.&nbsp; The software vendor has a TA that is supposed to fix time issues on ingest, but that hasn't been updated since 2018 and Splunk won't install it on the Cloud tenant.&nbsp;&nbsp;</P><P>How can I enforce the proper time zones at the HWF level?&nbsp; We have a HWF in each region where the logs are originating.&nbsp;&nbsp;</P><P>Thanks,</P><P>Garry<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screen Shot 2021-03-04 at 8.08.04 AM.png" style="width: 995px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/13179iB48B5665265D1704/image-size/large?v=v2&amp;px=999" role="button" title="Screen Shot 2021-03-04 at 8.08.04 AM.png" alt="Screen Shot 2021-03-04 at 8.08.04 AM.png" /></span></P> Thu, 04 Mar 2021 16:22:28 GMT https://community.splunk.com/t5/Getting-Data-In/Event-times-for-specific-log-file-are-incorrect/m-p/542382#M90627 garrywilmeth 2021-03-04T16:22:28Z https://community.splunk.com/t5/Getting-Data-In/Event-times-for-specific-log-file-are-incorrect/m-p/542393#M90628 <P>You have full control over your HF so you can install any app you need on it.&nbsp; If the app you want to use is outdated then update it yourself - that's why every app has a 'local' folder.</P><P>Do check the props.conf settings to ensure any time zones in the events are recognized properly.&nbsp; Use the TZ attribute for those sources that don't provide one.</P> Thu, 04 Mar 2021 17:52:38 GMT https://community.splunk.com/t5/Getting-Data-In/Event-times-for-specific-log-file-are-incorrect/m-p/542393#M90628 richgalloway 2021-03-04T17:52:38Z