Different timezone

[Mai_splunk]

Hi all!

I have a problem with the time my logs arrive. There is an hour difference. how can I solve that? If I have data from different clients with different timezone on the same server, how can I align them?

Thanks a lot!

[richgalloway]

Put the appropriate time zone name on each server.  Splunk knows its own time zone and will make the necessary conversions.

[richgalloway]

Ideally, each event's timestamp includes a time zone indication, but it appears your event timestamps do not.

The next best option is for the UFs on each server to have a TZ setting in the local props.conf file.  This time zone value is forwarded to the indexer so it can convert the timestamps properly.

[Mai_splunk]

Thanks for your quickly response @richgalloway 

Imagine that a client has UTM+2 and other with UTM+3. I configure their UF with that timezone, but my indexer has summer time and winter time UTM+1 and UTM+2 How can I manage this?