I've sat up monitoring of WinPrintMon on some Windows servers. The input using the WinPrintMon stanza, as described here, works just fine. The problem is that when the logs are parsed, the timezone as written in the logs are not recognized and included. That is, the logs clearly says "GMT" after the timestamp, but Splunk ignores that and assumes the timestamp is in the local timezone. Adding a props.conf on the indexer with correct timezone parsing (TIME_FORMAT = <strptime> + %Z) does nothing, but I assume this is because of the way Windows monitoring works, were the fields are actually extracted on the UF, if I understand correctly. I can't find any good documentation on this though. I tried adding a props.conf timezone parsing on the UF as well, but that also didn't help.
Unfortunately I can't provide the configuration files I've used here.
Any idea on how to troubleshoot/solve this?
