How to configure Splunk to convert the UTC timezone of my server into my local EST timezone?

[magneto417x]

I have and MHN server sending data to Splunk and it is being sent in UTC time. When I go in Splunk, I have event data that is 5 hours into the future because I'm in the eastern timezone. How can I fix this issue? Thanks

[richgalloway]

Add TZ = UTC to the relevant stanza of your props.conf file.

[magneto417x]

Which props.conf and how do you I determine relevant stanza???

[richgalloway]

The relevant stanza is the one matching the sourcetype of the event. It could be in any props.conf file, but you can find it using btool.

splunk btool --debug inputs list <sourcetype>

[magneto417x]

I ran that command with source type mhn-splunk and it returned nothing 😞

[richgalloway]

Make sure you pass the right sourcetype name to btool. Case is significant.

[magneto417x]

I grabbed the sourcetype out of splunk web interface. Looked at a few events and they all said

sourcetype=mhn-splunk

ran command splunk btool --debug inputs list mhn-splunk

no results came back

[richgalloway]

My mistake. btool should be looking at props.

splunk btool --debug props list mhn-splunk

[magneto417x]

Nothing returned using that either

[magneto417x]

Example of event sent to splunk. When Splunk gets it says it happened at 4:49pm Est when it actually happened at 11:49am Est

2017-02-23T16:49:45.582791 direction="inbound", protocol="ip", ids_type="network", dest="192.000.000.231", ssh_username="user", app="cowrie", transport="tcp", dest_port="22", src="203.00.000.73", src_port="54187", severity="high", vendor_product="Cowrie", sensor="f1abd5b4-f2ed-11e6-a7c2-00155d3f1218", ssh_password="cyprus1", signature="SSH login attempted on cowrie honeypot", ssh_version="SSH-2.0-libssh-0.1", type="cowrie.sessions"