Getting Data In
Highlighted

How to permanently adjust the timezone for IIS logs in Splunk Light on Windows?

New Member

Hi,

I am using Splunk Light for Windows, and I have imported some IIS Logs files, but the timezone is out by an hour.
I have been using the following as a workaround:

eval _time=_time-3600

What is the correct way to permanently adjust the timezone?

Thanks

0 Karma
Highlighted

Re: How to permanently adjust the timezone for IIS logs in Splunk Light on Windows?

SplunkTrust
SplunkTrust

I haven't used Splunk Light yet, but I assume the configs are the same. In your props.conf specification for the IIS sourcetype, set the Timezone explicitly. IIS knows nothing other than the GMT timestamp. So all events from IIS are in GMT.

[iis]
TZ = GMT
0 Karma