Timestamps and timezones

[MatMeredith]

My Splunk install is indexing logs that contain both a UTC timestamp and a timezone. Logs are being generated by devices spread across a range of timezones.

At the moment just the UTC timestamp is used and the timezone is currently ignored which is fine if I want to analyze logs based on the absolute time they occurred. But I'd also like to be able to analyze events based on the local time of day they were generated (i.e. the time of day as seen by the device that generated the logs).

I can obviously do that by manually calculating the "local time at which the event occured" at search time by performing a lookup of timezone to timezone offset and adding this to the timestamp. Is there any easier / more efficient way to do it though?

[kristian_kolb]

You should probably set the TIME_* properties in props.conf for your respective sources/sourcetypes/hosts. Depending on your architecture (Heavy Forwarder/Indexer only), you might have to set this in different places;

TIME_PREFIX = 
TIME_FORMAT =
MAX_TIMESTAMP_LOOKAHEAD =
TZ =

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/ApplyTimezoneOffsetstotimestamps
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configuretimestamprecognition

Hope this helps,

Kristian