Exchange CAS IIS timezone conversion issue?

[asofo]

I'm working with Exchange IIS data from our CAS servers and am having trouble with Splunk translating the time from UTC to EST at indexing time. Looking into this, Splunk is supposed to translate the time zone using the local time of the universal forwarder host. This is the case for all other IIS data in my environment, except for the CAS logs. I've tried to hard set the TZ in my props config, but to no avail. This is causing a 5 hour delay in log visibility.

This is how I'm seeing the time in the CAS IIS event:

This is how I'm seeing the time in other IIS events and how I want to see the CAS event time:

Has anyone run into this issue, or have a way to solve it? If Splunk is already able to handle IIS data, what makes CAS IIS data so different that the same rules don't apply? For the record, the version we're running is 6.6.1.

[woodcock]

You need to upgrade your forwarder. The documentation here:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Applytimezoneoffsetstotimestamps

says this:

If the forwarder and the receiving indexer are version 6.0 or later, use the time zone that the forwarder provides.

Then bounce your forwarder's Splunk instance(s).

The pre-v.6 way is to set a host-based stanza on your indexers to hardcode a value for TZ. Then bounce your indexers' Splunk instance(s).