What is the best way to adjust the time value for incoming syslog events from a specific host

[ntaylorsplunk]

I have a one host that has a time offset of +5 hours and would rewrite the timestamp to represent the local time zone before the event is indexed. What's the best way to do this?

[lukejadamec]

You would use the TZ parameter in props.conf
Here is a link to the documentation:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps

[ntaylorsplunk]

Forgot to mention, there is no timezone or offset information in the timestamp... The timestamp format from the incoming event is %b %d %T

[Masa]

No need to have timezone information in events. As lukejadamec is saying, you can make use of TZ attribute