In our Slave-Apps directory on the 2 peers/indexers we have a custom app created by the prev admin which has setting for TZ to UTC for network devices that are on UTC. Now i am adding new data source (i.e. AD security logs) using UFs on DCs and our DCs are all in EST TZ and hence i would need to list EST TZ in the props.conf.
My Questions are
1) Is this the right stanza for EST time entry
[WinEventLog://Security]
TZ = US/Eastern
I understand i will have to do this on master-apps folder on cluster master and then apply config bundle
2) Will this require a reboot of any peers ?
