How to change time from GMT to EST after ingesting IIS logs?

[satyaallaparthi]

Hello,

Need a help in changing time from (GMT+2) to EST.

When ever I am searching with 24 hours time frame then I am getting latest event with EST time. But, When ever I am changing to all time then I am getting the latest event with Germany time.

I tried props.conf with

[iis]
TZ = EST 

and

[iis]
TZ_ALIAS = EST=GMT+10:00

But both are not working.. Can any one help me with that?

Thanks in advance.

[VatsalJagani · Accepted solution]

Hello @satyaallaparthi,

You need to understand that TZ does not work at search time. All event timestamps stored in GMT epoch in Splunk. When you search the data it will be converted to timezone of your user preference.

TZ works at index-time, whatever timestamp Splunk extract from raw event that will all be considered to be in EST timezone (as specified in TZ). Then it converted from EST to GMT epoch and stored.

I hope you understand this. Once you understand this first check whether based on this concept have you set correct TZ? If yes then after check your user-preference timezone. Let me know if you have any other questions.