How to configure the timezone to prevent events from appearing in Splunk as 8 hours behind the present time?

[responsys_cm]

I have a light forwarder listening on tcp:514. It forwards data to three indexers, all of whose clocks are set to UTC time.

Several Cisco WSA proxy appliances are sending logs to the light forwarder. The WSAs don't support UTC time, so they are in US/Pacific and in Ireland.

Their syslog events arrive on tcp:514. A props/transforms identifies those events and changes the sourcetype to cisco:wsa:squid. It then routes that data to the "cisco" index rather than the "syslog" index.

The events are showing up in Splunk as being eight hours behind the present time.

I have tried:

[source::tcp:514]
TZ = US/Pacific

[cisco:wsa:squid]
TZ = US/Pacific

[host::10.10.10.10]
TZ = US/Pacific

And none of these work... I've also tried America/Los_Angeles, PDT, and PST. I feel like I'm taking crazy pills... what am I doing wrong?

[mrgibbon]

Hi, this is a format for props.conf I have used before, it might help.

# Props.conf

[source::udp]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = false
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %b %d %H:%M:%S
TZ = America/Chicago

set the host as from the incoming udp packet

TRANSFORMS-gethostfromdata = set_host