Getting Data In
Highlighted

Changing syslog timezone to Eastern Standard time.

New Member

I am having the same issue described here http://answers.splunk.com/answers/57543/splunk-displaying-events-with-the-correct-timezone.html.

My indexer is in EST and my syslog is coming from MST. I want the the indexer to change the logs from MST to EST. I have tried the suggested solution and that didn't solve the problem. Any other suggestions.

Thanks in advance.

Tags (1)
0 Karma
Highlighted

Re: Changing syslog timezone to Eastern Standard time.

Esteemed Legend

The problem is likely that you have overriden the host field and are trying to use your overriden/new host value in your props.conf stanza definition. This will not work. You must either use your original host value or use something else, such as sourcetype or source.

0 Karma