Hello everyone,
I have following problem:
I oberserve one host with splunk. The host has the timezone GMT+1:00.
The logfiles (FTP) have the timezone GMT+0:00.
I only forward the ftp-logs, not host-logs.
In the Splubk search, I have the logfile timestamp (e.g. 10:00:00,000) instead of (11:00:00,000)
I tried out several settings in props.conf like:
[source::.../log/ftp/*.log]
TZ = GMT
TZ = UCT
TZ = European/London
Nothing worked, yet.
Has someone a solution?
Entering TZ=UTC in indexer props.conf solve the problem.