Getting Data In

splunk shows time 4 hours behind.

kamalbeg
Explorer

I am getting some data from docker application. Client is telling me that in his log file the time stamp is up to date but when it comes to splunk, its 4 hours behind.

On indexer, I have created the props.conf file and have the following entry

more props.conf
[source::/var/tmp/log/*]
TZ = US/Eastern

How can I fix this?

Tags (1)
0 Karma

bcyates
Communicator

It sounds like the timestamp coming over is in UTC. Change your props to account for the difference.

[source::/var/tmp/log/*]
TZ = UTC

0 Karma

kamalbeg
Explorer

Both the client server and splunk servers are in EST

0 Karma

cmerriman
Super Champion

what is the user time zone set as?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...