How to configure different timezones for the source file that are coming into SPLUNK

[deepthi5]

Hi Team

I am facing issues with the following scenario
1.I have 200 csv files daily indexing into SPLUNK.
2.These 200 csv files are the network utilization reports coming from different routers configured
for example waterloo.csv (waterloo network utilization report)(EST timezone)
2.Sydney.csv(sydney network Utilization)(Australian timezone)
3.CEBU.csv(cebu netowrk Utilization)(sydney timezone)
4.Hyderabad.csv(Hyderabad network Utilization)(IST) etc
i have created few dashboards using this files but the time stamps that are shown are in EST only
how to change the timezone for each different source file that is getting indexed

Thanks and Regards,
Deepthi Bulusu.

[richgalloway]

Create separate props.conf stanzas for each source and specify the timezone for them. For example:

[source::waterloo.csv]
TZ=EST

[source::Hyderabad.csv]
TZ=IST

[source:: Sydney.csv]
TZ=+10:00

[deepthi5]

But i have got 200 csvs for different sites do you think i should update the props.conf file with this data and where should i place this props.conf file in whihc location should this be placed

[richgalloway]

Yes, you would need to create a stanza for each file or at least those in the "wrong" time zones. The props.conf file would go on your indexer(s).

Taking a step back for a moment. Could it be the time stamps are shown in EST because that's what your UI is set to? Having all the routers reported with a common time zone is more convenient for users and makes it easier to correlate events.