How do I control the trace line _time field

[avitallange]

I have a log file with traces of the format:
[source name] [level] [id]: [Time] [trace message]

Splunk auto identifies the _time field and indexes my trace log according to it.

The problem is that this time is a UTC representation and Splunk identifies it as some other timezone. (my user timezone is configured to GMT)

Example:
The original trace line:
TestTraceSource Information: 0 : Time: 08/29/2013 10:16:52, message . . .

Is indexed as:
_time: 08/29/2013 07:16:52


Trace: TestTraceSource Information: 0 : Time: 08/29/2013 10:16:52, message . . .

Regards,
Avital

[kristian_kolb · Accepted solution]

_time is normally the parsed timestamp from a message, and it is adjusted for timezone.

If for some reason Splunk has got the wrong timezone set for a particular input, this can be corrected/specified in props.conf

[spec]
TZ = UTC

will instruct splunk to treat events of type spec as being in the UTC timezone. spec can be one of either sourcetype, source::your_source_name or host::your_host.

See the following docs for more info;

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

/K