IIS FTP LOG TIMEZONE PROBLEM

[jscnet]

Using IIS FTP Server, Server 2008 RC2. FTP log format is W3C (UTC Timestamps). Splunk pulls the logs (entries) in just fine, however the time is wrong, that is, there's no conversion from UTC to US/Pacific.

I've looked on this forum and Google and tried modifying the /etc/system/local/props.conf file in the following way (btw: splunk is also running on Windows Server 2008 RC2):

[iis_ftp]
TZ = Etc/UTC

[iis]
TZ = Etc/UTC

AND ...

[sourcetype::iis_ftp]
TZ = Etc/UTC

[sourcetype::iis]
TZ = Etc/UTC

Neither works, no conversion to US/Pacific (or my local timezone). I of course restarted splunk after modifying props.conf. I've looked at the following:

http://splunk-base.splunk.com/answers/9666/iis-log-timezone
http://splunk-base.splunk.com/answers/1425/timezones-iis-w3c-extended-logging-why-dont-they-work
http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/ApplyTimezoneOffsetstotimestamps
http://splunk-base.splunk.com/answers/28442/log-time-differs-from-time-on-splunk-host

This to me should be an obvious no-brainer and a VERY common topic. Perhaps I've misread something in those articles -- just doesn't work. Any solutions? Thanks, J.

[ziegfried · Accepted solution]

Have you tried using:

TZ = UTC

[DominikW]

Worked here also! Thank you!

[jscnet]

Thanks @Ziegfried. That worked.

[yannK]

are not IIS logs ALWAYS in GMT ?

[jscnet]

Using Splunk version 4.2.3