Is there a way (if possible) to stamp the time zone of the machine running universal forwarder in the events (Windows eventlogs)? Both our indexers and UFs are on V6 and we get the source machine timestamp in Splunk. We are interested in getting the source machine timezone which can be helpful if we plan to forward the data to third party apps.
Splunk supplies you with what it interpreted the TZ to be for each event in the date_zone field. If this value is local, then the TZ of the indexing server (in the splunk_server field) was used.
The date_zone field is empty for the events. How can I set it up? Is it by using TZ in local/props.conf on the indexer, I tried it but it never worked (tried with [source::*] and [] as well).
This means that they came in from a modular input and it was probably timestamped with the the time that it was indexed or it was a WinEventLog:* and I don't know what those timestamps do.
