We have some log data where each line starts with a timestamp that looks like this:
Nothing else in the data looks anything like a timestamp.
Splunk is indexing this as UTC, so it displays 4 hours earlier.
The timezone on the source server is in Eastern.
We are running a Splunk Universal Forwarder there, so on the Heavy Forwarder, I have the following:
[my_sourcetype_here] TZ = US/Eastern
For what it's worth, I also tried with [host::hostnamepattern*]
Neither seem to have taken effect with newly-indexed events, despite actually restarting the Heavy forwarders!
Am I missing something here?
If Splunk is indexing in UTC, then your server is likely set to use UTC. See this link for help on how Splunk sets time zones:
I was having a similar issue, running in Central time. I created a props.conf file within the C:\Program Files\Splunk\etc\system\local filepath with just the value TZ = UTC-6, Eastern would likely be UTC-5 and my timestamps are displaying correctly. Unfortunately I don't see my props.conf file in that directory anymore but the timestamps are still working correctly.
A bit unclear about the setup - is it UF -> HF -> Indexer?
TZ settings should go to where the parsing phase takes place - in the above scenario, that would be the HF (As can be seen here).
Have you tried either
-04:00 instead of