Hello,
I'm trying to configure an ingestion of logs that are in UTC time.
We are in Geneva and timezone is Europe/Zurich (=UTC+2), so, logs are displayed with the wrong date.
For example, log ingested at 14:52 today is displayed in Splunk like this :
2023-07-05 12:52:40 ..
These logs are coming from a simple UF (Windows, UF version is 8.2.4). My Splunk environment is Linux (RedHat 8 / Splunk version is 9.0.4)
As documented, I tried to add in a props.conf something like this :
[source::D:\path\to\file.log]
TZ = Europe/Zurich
First I added it in the UF configuration. No effect.
Then I tried to put it on indexers. No effect.
I also tried to use the sourcetype name ([my_sourcetype] ) instead of the source path or replace the Europe\Zurich value with "TZ = UTC+2"... it didn't work any better.
Help would be appreciated !
Thanks
David
