Hi Please help me fix this would like to consider the TIME stamp extracted from the events , but i see two different time format s in events as you can see in below events .
And , the search head settings has default time zone settings --- CST zone .
Here is the props.conf i have written . Please help me parse the correct time stamp.
[smr]
pulldown_type = true
NO_BINARY_CHECK=true
disabled=false
SHOULD_LINEMERGE=true
MAX_TIMESTAMP_LOOKAHEAD=150
MAX_EVENTS=15000
TRUNCATE=100000
I can see that the time off set with the actual events and the splunk time zone has 1 and half hour difference . one hours 30 mins diff.