How to fix an incorrectly indexed timestamp?

[mholden37]

Splunk is not showing the correct time on the events. The time that Splunk gives the log is 5 hours behind the time that it is supposed to be. The time is correct on the server and the logs but Splunk is saying it is 5 hours behind. For the below timestamp it is giving it a time of 8:48:06.000 AM when it should be 1:48:06.000PM.

2017-02-22T13:48:06Z

In props.conf I have TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ

I have also tried changing the timezone to TZ = UTC and that did not fix it.

[aaraneta_splunk]

@mholden37 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

[sloshburch]

What happens when you set the time to be parsed automatically?
Alternatively, try using the strptime to validate the string parsing.
For example, you could also try %FT%TZ as per https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

[richgalloway · Accepted solution]

If your Splunk is in the US eastern time zone then 13:48:06Z correctly converts to 08:48:06 EST. The "Z" says the timestamp is in UTC so Splunk converts it to the local time zone. If that is not the expected behavior then change the server to specify the correct time zone in its events.