I'm working with Exchange IIS data from our CAS servers and am having trouble with Splunk translating the time from UTC to EST at indexing time. Looking into this, Splunk is supposed to translate the time zone using the local time of the universal forwarder host. This is the case for all other IIS data in my environment, except for the CAS logs. I've tried to hard set the TZ in my props config, but to no avail. This is causing a 5 hour delay in log visibility.
This is how I'm seeing the time in the CAS IIS event:
This is how I'm seeing the time in other IIS events and how I want to see the CAS event time:
Has anyone run into this issue, or have a way to solve it? If Splunk is already able to handle IIS data, what makes CAS IIS data so different that the same rules don't apply? For the record, the version we're running is 6.6.1.