Getting Data In

Where to convert GMT for cluster?


I installed the Splunk Add-On for AWS on my HF and created an input with a custom data type to ingest the AWS instance logs (basically Linux and Windows event logs), with a custom sourcetype of aws:s3:hostOS, but the problem is when I search the logs the timestamps are showing up as +4. I'm EST and the OS logs are GMT.

Do I need to modify the  props.conf on my HF to adjust for GMT, or on the SH cluster, or on both the HF and SH cluster?


Labels (3)
0 Karma


It could be the TIME_FORMAT is not correct to the time zone is not detected correctly or maybe the TZ attribute needs to be added.

Please share the props.conf settings for the aws:s3:hostOS sourcetype.  Please also share some example events so we can see what the timestamps look like.

If this reply helps you, an upvote would be appreciated.



Thx for the reply.

The input I had to use was the custom data type that does not have a corresponding stanza in props.conf.

I was seeing events as follows with timestamps a few hours ahead:

Oct 22 22:10:01 ip-X-X-X-X systemd: Stopping User Slice of root.


 I created a props.conf file in the local dir of the add-on on my HF and added the following stanza:


and now when I run a search the timestamps are as follows:

Oct 22 22:13:06 ip-x-x-x-x dhclient[3010]: XMT: Solicit on eth0, interval 127130ms.


I believe this fixed the issue


0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...