Splunk - Server and Application logs timestamps are different

[vilashegde]

We have a set of servers where the server Timezone is in PST/PDT but the application running on that server has log timestamps in UTC. We have setup some Alerts on those servers. Due to the timestamp mis-match, the alerts are triggered with the delay of 7 or 8 hours depending on whether Daylight saving is in effect (Since PST = UTC-8 and PDT=UTC-7). Splunk is considering the application log timestamp in PST/PDT and reporting accordingly.
Is there any way around this? Please suggest.

[renjith_nair]

Hi @vilashegde,

You can set the timezones for events in props conf as mentioned in Apply timezone offsets to timestamps
This could be done based on the source or sourcetype or host