Forwarded TZ won't be "translate" in own TZ

[chrisitanmoleck]

Hello everyone,

I have following problem:

I oberserve one host with splunk. The host has the timezone GMT+1:00.
The logfiles (FTP) have the timezone GMT+0:00.
I only forward the ftp-logs, not host-logs.

In the Splubk search, I have the logfile timestamp (e.g. 10:00:00,000) instead of (11:00:00,000)

I tried out several settings in props.conf like:
[source::.../log/ftp/*.log]
TZ = GMT
TZ = UCT
TZ = European/London

Nothing worked, yet.

Has someone a solution?

[chrisitanmoleck · Accepted solution]

Entering TZ=UTC in indexer props.conf solve the problem.