I am working on demo using Splunk. I have a tool which uploads json data to Windows Event Log and Splunk UW forwards the data to Splunk instance (on the same machine). The json event has a field called timestamp which I plan to use for event time in splunk. I also want to interpret timestamp as from a different timezone (Europe/Lisbon). I have changed the file $SPLUNK_HOME/etc/system/local/props.conf and added:
I expect the event in splunk to show the time of the event as that in timestamp field and also changed by 8 hours since my computer region is PST. But it doesnt seem to have any effect on the time. The event time is shown as the time event was posed to Windows Event log. Here is a sample event:
You are testing it wrong. The raw event text will never change; it will always be whatever it always was. The interpretation as used by the Time picker and the Time column in the Events tab is somewhat hard to understand because it is adjusted to your personal Time zone setting. Make sure to set your <Your Name> -> Settings -> Time zone to an appropriate value and you will see that indeed, it does work as presented by the Time column.