Event times for specific log file are incorrect

[garrywilmeth]

Hello,

I am encountering an issue with the event times for a specific set of logs.  We have been using Splunk Cloud for a little over a year now and I haven't experienced this issue with other sources/data.

Most of the servers are located in PST and the events are being logged UTC.  The software vendor has a TA that is supposed to fix time issues on ingest, but that hasn't been updated since 2018 and Splunk won't install it on the Cloud tenant.  

How can I enforce the proper time zones at the HWF level?  We have a HWF in each region where the logs are originating.  

Thanks,

Garry

[richgalloway]

You have full control over your HF so you can install any app you need on it.  If the app you want to use is outdated then update it yourself - that's why every app has a 'local' folder.

Do check the props.conf settings to ensure any time zones in the events are recognized properly.  Use the TZ attribute for those sources that don't provide one.