Timezones - what am i missing?

[Sqig]

Hi.

We have some log data where each line starts with a timestamp that looks like this:

2012-09-28 15:44:35,302

Nothing else in the data looks anything like a timestamp.

Splunk is indexing this as UTC, so it displays 4 hours earlier.

The timezone on the source server is in Eastern.

We are running a Splunk Universal Forwarder there, so on the Heavy Forwarder, I have the following:

[my_sourcetype_here]
TZ = US/Eastern

For what it's worth, I also tried with [host::hostnamepattern*]

Neither seem to have taken effect with newly-indexed events, despite actually restarting the Heavy forwarders!

Am I missing something here?

Thanks.

[Sqig · Accepted solution]

If I could remove a question I have posted, I would in this case. This was user error on my part and not anything to do with Splunk.

[sowings]

If Splunk is indexing in UTC, then your server is likely set to use UTC. See this link for help on how Splunk sets time zones:

http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/ApplyTimezoneOffsetsToTimeStamps

[jcaffero]

I was having a similar issue, running in Central time. I created a props.conf file within the C:\Program Files\Splunk\etc\system\local filepath with just the value TZ = UTC-6, Eastern would likely be UTC-5 and my timestamps are displaying correctly. Unfortunately I don't see my props.conf file in that directory anymore but the timestamps are still working correctly.

JC

[kristian_kolb]

A bit unclear about the setup - is it UF -> HF -> Indexer?

TZ settings should go to where the parsing phase takes place - in the above scenario, that would be the HF (As can be seen here).

Have you tried either EST or -04:00 instead of US/Eastern?

/Kristian