Getting Data In

How to change time from GMT to EST after ingesting IIS logs?

satyaallaparthi
Communicator

Hello,

Need a help in changing time from (GMT+2) to EST.

When ever I am searching with 24 hours time frame then I am getting latest event with EST time. But, When ever I am changing to all time then I am getting the latest event with Germany time.

I tried props.conf with

[iis]
TZ = EST 

and

[iis]
TZ_ALIAS = EST=GMT+10:00

But both are not working.. Can any one help me with that?

Thanks in advance.

0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @satyaallaparthi,

You need to understand that TZ does not work at search time. All event timestamps stored in GMT epoch in Splunk. When you search the data it will be converted to timezone of your user preference.

TZ works at index-time, whatever timestamp Splunk extract from raw event that will all be considered to be in EST timezone (as specified in TZ). Then it converted from EST to GMT epoch and stored.

I hope you understand this. Once you understand this first check whether based on this concept have you set correct TZ? If yes then after check your user-preference timezone. Let me know if you have any other questions.

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Hello @satyaallaparthi,

You need to understand that TZ does not work at search time. All event timestamps stored in GMT epoch in Splunk. When you search the data it will be converted to timezone of your user preference.

TZ works at index-time, whatever timestamp Splunk extract from raw event that will all be considered to be in EST timezone (as specified in TZ). Then it converted from EST to GMT epoch and stored.

I hope you understand this. Once you understand this first check whether based on this concept have you set correct TZ? If yes then after check your user-preference timezone. Let me know if you have any other questions.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...