Using IIS FTP Server, Server 2008 RC2. FTP log format is W3C (UTC Timestamps). Splunk pulls the logs (entries) in just fine, however the time is wrong, that is, there's no conversion from UTC to US/Pacific.
I've looked on this forum and Google and tried modifying the /etc/system/local/props.conf file in the following way (btw: splunk is also running on Windows Server 2008 RC2):
[iis_ftp] TZ = Etc/UTC [iis] TZ = Etc/UTC
[sourcetype::iis_ftp] TZ = Etc/UTC [sourcetype::iis] TZ = Etc/UTC
Neither works, no conversion to US/Pacific (or my local timezone). I of course restarted splunk after modifying props.conf. I've looked at the following:
This to me should be an obvious no-brainer and a VERY common topic. Perhaps I've misread something in those articles -- just doesn't work. Any solutions? Thanks, J.