Timestamp mismatch occurring from events with the Splunk timestamp .

[guru865]

Hi Please help me fix this would like to consider the TIME stamp extracted from the events , but i see two different time format s in events as you can see in below events .
And , the search head settings has default time zone settings --- CST zone .
Here is the props.conf i have written . Please help me parse the correct time stamp.

[smr]
pulldown_type = true
NO_BINARY_CHECK=true
disabled=false
SHOULD_LINEMERGE=true
MAX_TIMESTAMP_LOOKAHEAD=150
MAX_EVENTS=15000
TRUNCATE=100000

[guru865]

I can see that the time off set with the actual events and the splunk time zone has 1 and half hour difference . one hours 30 mins diff.

[cpetterborg · Accepted solution]

See:

https://answers.splunk.com/answers/216905/how-to-handle-a-logfile-with-two-timestamps.html