topic Re: splunk shows time 4 hours behind. in Getting Data In

splunk shows time 4 hours behind.

kamalbeg — Wed, 31 Oct 2018 18:28:05 GMT

I am getting some data from docker application. Client is telling me that in his log file the time stamp is up to date but when it comes to splunk, its 4 hours behind.

On indexer, I have created the props.conf file and have the following entry

more props.conf
[source::/var/tmp/log/*]
TZ = US/Eastern

How can I fix this?

Re: splunk shows time 4 hours behind.

cmerriman — Wed, 31 Oct 2018 20:26:46 GMT

what is the user time zone set as?

Re: splunk shows time 4 hours behind.

kamalbeg — Thu, 01 Nov 2018 12:55:43 GMT

Both the client server and splunk servers are in EST

Re: splunk shows time 4 hours behind.

bcyates — Thu, 01 Nov 2018 15:41:08 GMT

It sounds like the timestamp coming over is in UTC. Change your props to account for the difference.

[source::/var/tmp/log/*]
TZ = UTC