I have an event in my log that contains the following information
* Event Time
* Post Event Time 1
* Post Event Time 2
* Post Event Time 3
The original event sends the time as UTC+0. I have adjusted my sourcetype to set the TZ as required and the logs are now coming in with the appropriate offset into SPLUNK instance. For example the TZ is set to +8. If my time was 12:30pm then the log comes through as follows for example:
* Event Time ==> 12:30pm 09/04/2020 ==> this is accurate as my props is doing what I want it to do.
The problem is that the other time fields in the event (the source is CEF) show as "alphabetic" fields (string) so not true times.
I can adjust the times by using strp/strf time to get what I need but what I would like to know is can I do this at ingest time (so via something like props/transforms) as opposed to in a search? The Event Time (ingest time) works exactly as required so that doesnt need to change. This is purely for the other non "_time" fields.