I have a problem regarding Splunk showing incorrect timestamps:
Splunk pretty much shows me timestamps with a 5 hour delay. If an something is logged in the logs I monitor, it is logged in EST (it says GMT -5:00 though and I think that is the problem). However the log looks like this:
It reads GMT -5:00 in the log file and Splunk goes ahead and reads that and shows me the logs only 5 hours after the event occurs. The log file however is written in EST and not GMT.
I changed my props.conf to tell Splunk that we are in EST. What could I change in order for Splunk to just read the timestamp out of the log without GMT -5:00, because I think this where the problem comes from.