Changing syslog timezone to Eastern Standard time.

[fisan]

I am having the same issue described here http://answers.splunk.com/answers/57543/splunk-displaying-events-with-the-correct-timezone.html.

My indexer is in EST and my syslog is coming from MST. I want the the indexer to change the logs from MST to EST. I have tried the suggested solution and that didn't solve the problem. Any other suggestions.

Thanks in advance.

[woodcock]

The problem is likely that you have overriden the host field and are trying to use your overriden/new host value in your props.conf stanza definition. This will not work. You must either use your original host value or use something else, such as sourcetype or source.