Getting Data In

Changing syslog timezone to Eastern Standard time.

New Member

I am having the same issue described here

My indexer is in EST and my syslog is coming from MST. I want the the indexer to change the logs from MST to EST. I have tried the suggested solution and that didn't solve the problem. Any other suggestions.

Thanks in advance.

Tags (1)
0 Karma

Esteemed Legend

The problem is likely that you have overriden the host field and are trying to use your overriden/new host value in your props.conf stanza definition. This will not work. You must either use your original host value or use something else, such as sourcetype or source.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...