Setting timezone is not working

[strive]

Hi,

We are using Splunk 6.0.3

The host (no matter where it is located) always sends logs with UTC time. In my props.conf file i have added TZ = UTC in the stanza that processes the logs. But still i see the _time as forwarder's time zone.

My Props.conf looks like this:

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)\d{2}-[a-zA-Z]{3}-\d{4}\s\d{2}:\d{2}:\d{2}\s

MAX_TIMESTAMP_LOOKAHEAD=20

TIME_PREFIX=^

TIME_FORMAT=%d-%b-%Y %H:%M:%S

TZ=UTC

Thanks

Strive

[lukejadamec · Accepted solution]

Splunk will set event time zones according to the following priority:

1) It will use the time zone in the raw event data.

2) It will use the time zone in props.conf

3) If both the forwarder and indexer are 6.0 or later, then it used the time zone of the forwarder.

In your case, the time zone of the event is UTC because the time zone is included in the event.

However, because your MAX_TIMESTAMP_LOOKAHEAD is set to 20, Splunk never sees the time zone so it can't apply it.

I’m not sure why it does not check props.conf before it moves on to the third priority. Perhaps the props.conf is in the wrong location?

Regardless, change your MAX_TIMESTAMP_LOOKAHEAD to 30.

[strive]

The issue was with forwarder. It is resolved.

[jdhruti]

what's was the issue? we are having the same issue where the timezone is set as UTC, but it still indexes data in EDT.

[strive]

Thanks for your response. props.conf is inside /IndexAPP/local/ directory. This splunk app is added to peer nodes (indexers).

Note: we use clusters