Times Unchanged For Newly Indexed Data After Time Zone Config Changes

[mj9999]

I am using splunk-5.0.4-172409-x64 for Windows and can't get the time zone to offset from GMT to CDT. I have changed to central time in my user settings as well as made recommended changes to the props.conf file.

I do not expect these changes to affect old data. But newly indexed data is unaffected by the changes.

[BenAveling]

If you change the timezone for the user it should affect the display of all data, old and new. But it won't change what is stored, either for old or new data.

If you change the central timezone, or the timezone for a particular stream of log data, then that should change the timezone of any new data that is not explicitly stamped with a timezone. Events that already contain their own timezone will not be affected, nor will old events, if I understand what you are asking.

[yannK]

Is there already a timezone in the events ?
check the result with
host=myhost | convert ctime(_indextime) AS indextime | table _time indextime date_zone _raw

[mj9999]

\etc\system\local

[host::myhost]
TZ = CDT

Yes, restarted.

[lukejadamec]

What are the input types, which props.conf file did you edit, what did you put in props.conf, did you restart splunk?