Why are our Cisco Syslog hosts showing up as time zone instead of IP and how do I fix this?

[mikewedge808]

I have recently started sending logs for my Cisco devices to Splunk. Most of my logs show the IP address of the device as the host on the log, but a growing number now show our timezone or "HST". How do I get this to stop and show the source IP address?

[esix_splunk]

Check the timezone configuration on your host and on your Splunk instance. Most likely the time zone is getting picked up as HST. You can change this in the props.conf for your sourcetype also as 'TZ = XXXX' directive.

http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Applytimezoneoffsetstotimestamps?r=searchtip

[esix_splunk]

Are your transforms getting applied at index time, or only search time? The Cisco app does have indexer side requirements, so if you dont have the TA installed in the right locations, it wont index and parse correctly.
Additionally, if this is only effecting a subset of your hosts, have you confirmed that they are logging in the same format as the hosts that are working correctly?

[mikewedge808]

HST is our correct timezone. Unfortunately the problem is some of my logs show "Host=HST" instead of "Host=X.X.X.X".